Identifying IP address of filtering devices in the Great Firewall of China

Re:Identifying IP address of filtering devices in the Great ... by xfs on Monday December 17, 2012 @08:02AM (#4932088)

The GFW doesn't really have filtering devices with IP addresses.

For filtering in literal sense, i.e. address based packet null routing, all you can find is general carrier routers with their routing tables being dynamically manipulated by BGP commands sent by the GFW. You can't know where the commands come from.

For "filtering" described in this research, it's active connection disruption with spoofed tcp reset packets. The GFW mirrors traffic via some routers for detection and sends spoofed traffic for disruption. It doesn't have an IP address per se. This tool can find out from which router the GFW mirrors traffic, but not the GFW itself.

Here is a previous illustration on the topology of GFW networks: https://media.torproject.org/image/community-images/topology...

[ Parent | on HN ]

Re:Identifying IP address of filtering devices in the Great ... by mothran on Monday December 17, 2012 @12:38PM (#4933304)

It could be modified to detect both ends of the mirror devices. I would warn against trusting that model of the GFW because devices are not all placed at the inbound international connections. I have found that most devices are deployed farther down the network chain into the regional level last 10-100 miles ish. For example I have detected a GFW mirror or device in Tibet.

[ Parent | on HN ]