流量识别有更新？ CDN + TLS + WS build 已不再可靠。

[swatchion]

近期多事之秋。 可以明显感到某墙发威了。

针对域名进行了一系列的识别，当发现有大流量的传输时，会使用 TCP RST packat 重置链接。

大佬们需要针对 CDN + TLS + WS build 做进一步的优化。 能力有限，以上仅是推测。

[swatchion]

其他的传输层协议如 grpc 、 mkcp 是否可用？

[cross-hello]

@swatchion Could you share some packets captured via Wireshark? You could remove server info from pcapng file from using the code of https://github.com/cross-hello/Replace-IP-and-Ethc-mac-in-pcapng-file

[he583899772]

vmess+tls+ws 已经不可靠，目前封端口，不管是443，还是其他端口，已经到达分钟级别封

[cross-hello]

It must be some misconception inside. All our severs survive at the time.

…

---------------------------------------- *From: *he583899772 ***@***.***> *To: *v2fly/v2ray-core ***@***.***> *CC: *Nanyu ***@***.***>; Comment ***@***.***> *Date: *Nov 30, 2022 13:36:46 *Subject: *Re: [v2fly/v2ray-core] 流量识别有更新？ CDN + TLS + WS build 已不再可靠。 (Discussion #2187)

vmess+tls+ws 已经不可靠，目前封端口，不管是443，还是其他端口，已经到达分钟级别封 — Reply to this email directly, view it on GitHub[#2187 (comment)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYAMGNXWGHFWZ3XVHX3WK5J63ANCNFSM6AAAAAASPJTFGA]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYENM7LP6XBWHDS42YLWK5J63A5CNFSM6AAAAAASPJTFGCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAIE3GQ.gif]Message ID: ***@***.***>

[cross-hello]

Based one Encryption method charactics, neural network can't effectively distinguish. (see experiment here: XTLS/Xray-core#1295 (reply in thread) ) So it may be based on packet length combining with time or something others. Not matter what it is, absolutely accurate is impossible. In the high react of blocking it must block other normal service at the same time.

…

---------------------------------------- *From: *he583899772 ***@***.***> *To: *v2fly/v2ray-core ***@***.***> *CC: *Nanyu ***@***.***>; Comment ***@***.***> *Date: *Nov 30, 2022 13:36:46 *Subject: *Re: [v2fly/v2ray-core] 流量识别有更新？ CDN + TLS + WS build 已不再可靠。 (Discussion #2187)

vmess+tls+ws 已经不可靠，目前封端口，不管是443，还是其他端口，已经到达分钟级别封 — Reply to this email directly, view it on GitHub[#2187 (comment)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYAMGNXWGHFWZ3XVHX3WK5J63ANCNFSM6AAAAAASPJTFGA]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYENM7LP6XBWHDS42YLWK5J63A5CNFSM6AAAAAASPJTFGCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAIE3GQ.gif]Message ID: ***@***.***>

[MakeFortuneQuietly]

我目前人不在国内，谁能帮测下我的vless+tls+ws+cdn+tor节点？是个人闲置欧服

[jiangangwu]

我可以

[MakeFortuneQuietly]

订阅
https://dushuxyz.ml/hyperlinks/freedom/vl-sub

[swatchion]

if you want to keep your line live long, do not use it for bt download. It works fine before I use it for download. The traffic amount may cause the trigger happened.

…

On Fri, Dec 2, 2022 at 4:05 AM Tracy Tsu ***@***.***> wrote: 我目前人不在国内，谁能帮测下我的vless+tls+ws+cdn+tor节点？是个人闲置欧服 — Reply to this email directly, view it on GitHub <#2187 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFC5QOOI7KC5J5MCX4E6JODWLEAIRANCNFSM6AAAAAASPJTFGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[MJamshidnejad]

Something happened to me too. We need to think about ESNI.

[kingwilliam]

在14億人大國 已法規明文 絕對禁止 ESNI

[MJamshidnejad]

Something similar happened here. Any packet which is set up Host or SNI with filtered domain get dropped. However it doesn't happen in local servers....Just mobile and broadband services!

[Xyncgas]

You don't know why, you don't have packet captured, this is a nothing burger though

[cross-hello]

Then what about E(ncrypted) C(lient) H(ello)?

…

---------------------------------------- *From: *kingwilliam ***@***.***> *To: *v2fly/v2ray-core ***@***.***> *CC: *Nanyu ***@***.***>; Comment ***@***.***> *Date: *Dec 7, 2022 00:10:01 *Subject: *Re: [v2fly/v2ray-core] 流量识别有更新？ CDN + TLS + WS build 已不再可靠。 (Discussion #2187)

在14億人大國 已法規明文 絕對禁止 ESNI — Reply to this email directly, view it on GitHub[#2187 (reply in thread)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYF7SURGBNTR4UTWJP3WL7IVRANCNFSM6AAAAAASPJTFGA]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYH7U3T5BQFTMRSAOM3WL7IVRA5CNFSM6AAAAAASPJTFGCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAIIFPM.gif]Message ID: ***@***.***>

[kingwilliam]

Date: August 07, 2020

en : https://gfw.report/blog/gfw_esni_blocking/en/
cn : https://gfw.report/blog/gfw_esni_blocking/zh/

ESNI:

- We confirm that the Great Firewall (GFW) of China has recently begun blocking ESNI—one of the foundational features of TLS 1.3 and HTTPS.

- 我们确认中国的防火长城（GFW）已经开始封锁ESNI这一TLS1.3和HTTPS的基础特性

ECH:

- As informed by an anonymous reviewer on the riseup pad, the currently deployed ESNI uses extension value 0xffce (see Section 8.1). However, the newer ECH uses extension value 0xff02, 0xff03 and 0xff04(Section 11.1). We confirm no censorship has been observed on these extension values yet.

- 现有的ESNI使用0xffce作为扩展值（详见 Section 8.1）。 但时新的ECH使用0xff02，0xff03和0xff04作为扩展值（Section 11.1). 我们确认这些新的扩展值还未被封锁。

[MJamshidnejad]

Date: August 07, 2020

en : https://gfw.report/blog/gfw_esni_blocking/en/ cn : https://gfw.report/blog/gfw_esni_blocking/zh/

ESNI:

- We confirm that the Great Firewall (GFW) of China has recently begun blocking ESNI—one of the foundational features of TLS 1.3 and HTTPS.

- 我们确认中国的防火长城（GFW）已经开始封锁ESNI这一TLS1.3和HTTPS的基础特性

ECH:

- As informed by an anonymous reviewer on the riseup pad, the currently deployed ESNI uses extension value 0xffce (see Section 8.1). However, the newer ECH uses extension value 0xff02, 0xff03 and 0xff04(Section 11.1). We confirm no censorship has been observed on these extension values yet.

- 现有的ESNI使用0xffce作为扩展值（详见 Section 8.1）。 但时新的ECH使用0xff02，0xff03和0xff04作为扩展值（Section 11.1). 我们确认这些新的扩展值还未被封锁。

So we've reached a dead end! right?

[kingwilliam]

i don't think so, just can't use tls 1.3 some special feature

[MJamshidnejad]

i don't think so, just can't use tls 1.3 some special feature

Do you have any solutions for the problem that I mentioned above? I was thinking about ESNI, but it doesn't seem like a real solution.
#2187 (reply in thread)