Time to get funds for 443 port vpn startups. ;)
Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.
Hint: TLS encrypted traffic following an appropriate browser-style handshake cannot be distinguished from "legitimate" https.
As in, it is not only a passive observer periodically resetting connections, it will also make its own to test the waters
- In-Depth Analysis of the Great Firewall of China. Has other good sources at the bottom: http://www.cs.tufts.edu/comp/116/archive/fall2016/ctang.pdf
- How China is Blocking Tor: https://arxiv.org/abs/1204.0447
- Summary of "How China is Blocking Tor" from MIT Review: https://www.technologyreview.com/s/427413/how-china-blocks-t...
No DPI needed.
Until this is circumvented there is no real solution.
Wildcard blocking of these would break too many legitimate services, including banking, airlines, etc.
BTW, the task of DPI-ing of all https traffic on the operator side is intractable.