And based the log on my hand, probing is really "mainstream" now days. I have a Shadowsocks proxy instance started since Oct 20 last year, and it's been attacked

    $ docker logs shadowsocks 2>&1| grep "AEAD: repeat salt detected" | wc -l
    16468

times total. The last 6 happened less than 10 minutes ago. My expectation is, TLS will be probed even more, because the handshake parameters (the order of CipherSuite for example) itself could leak a lots of info about the client&server.

It's not easy to build a protocol that is cryptographically safe all while keep the traffic characterless/innocent. Could be a "World Changing Event" if somebody discovered a way through.