How do you check that? The DPI works mostly in async way, mirror traffic to standalone servers to extract key data points, if found a match, send RST to drop the TCP stream and maybe further blacklist the IP indefinitely.
Is there a new mechanism that requires synchronised data stream check? Making a DPI on backbone internet with <100ms latency would be extremely impressive achievement.
searched for "Great firewall latency" on my mobile. Took the first result with numbers, and saw mainland latency around 100ms higher than HK.
> The DPI works mostly in async way, mirror traffic to standalone servers to extract key data points, if found a match, send RST to drop the TCP stream and maybe further blacklist the IP indefinitely.
If it works async like you describe then it invalidates my worries about latency. But it doesn't solve the "why the hell is my SSH stream getting a RST?!" because their firewall is dropping SSH by policy or because of a false positive in the traffic.
Found few blog posts, it looks like network congestion.
Yeah it may well exists, because if DPI servers can't handle all the oversaturated traffic, it may well just cap the backbone bandwidth, dropping packets, etc.
So if your packets has to be retransmitted it creates latency.
In this particular case, we don't have any business interest in mainland china, so I'm willing to speculate based on other people's measurements. Acting on speculation is very different from planning. As smarter people than me have said: "plan for the worst; hope for the best"