How China Detects and Blocks Shadowsocks
Alice, Bob, Carol Carol, Jan Beznazwy, Amir Houmansadr
Abstract
Shadowsocks is one of the most popular circumvention tools in China. Since May 2019, there have been numerous anecdotal reports of the blocking of Shadowsocks from Chinese users. In this study, we reveal how the Great Firewall of China (GFW) detects and blocks Shadowsocks and its variants. Using measurement experiments, we find that the GFW uses the length and entropy of the first data packet in each connection to identify probable Shadowsocks traffic, then sends seven different types of active probes, in different stages, to the corresponding servers to test whether its guess is correct.
Topics & Concepts
Firewall (physics)Computer scienceServerBlocking (statistics)Network packetChinaIp addressEntropy (arrow of time)Computer networkComputer securityGeographyCharged black holeArchaeologyPhysicsExtremal black holeQuantum mechanicsNetwork Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingNetwork Packet Processing and Optimization