China's Great Firewall Tests Mysterious Scans On Encrypted Connections

Re:China's Great Firewall Tests Mysterious Scans On Encrypte... by asharp on Monday November 21, 2011 @05:44AM (#3260670)

You can fairly easily spot most common protocols by seeing what they 1) Say to you without you prodding them or 2) Respond when you hit them with random data.

My guess is that they're using it as a cheap way to tell the difference between most of the common protocols. (ie. ssh vs. openvpn vs. https, etc.)

[ Parent | on HN ]

Re:China's Great Firewall Tests Mysterious Scans On Encrypte... by huetsch on Monday November 21, 2011 @06:01AM (#3260711)

Would an outgoing ssh request be hard to discriminate from an outgoing openvpn request or an outgoing https request? I don't know enough about how the protocols work to understand.

[ Parent | on HN ]

Re:China's Great Firewall Tests Mysterious Scans On Encrypte... by kahawe on Monday November 21, 2011 @10:33AM (#3261415)

> Would an outgoing ssh request be hard to discriminate from an outgoing openvpn request or an outgoing https request?

No. But the point probably is: it is much easier and more economic to block the receiving end once by figuring out what it is than having to scan every single outgoing connection all the time.

[ Parent | on HN ]