The great firewall of China



The great firewall of China may be just an illusion in technical terms. This article describes the details of how things work…. Basically when “banned content” is detected, both ends of the connection are sent a flood of tcp reset packets. Which (if both sides are designed to pay attention to) means that the two computers “hang up” assuming the other side reset the connection. But, while most current PC operating systems obey the reset packets…. it’s not something that is imperative. (You might think of this as a targeted/surgical denial of service attack using TCP reset packets…) The article goes a bit deeper though….


What if the pcs ignored reset packets…. yes they could. There’s no rule that a tcp stack HAS to obey a reset packet. IF the packets were ignored the firewall would turn out to be nothing more than an illusion technically speaking. Because the pcs on either end would continue communicating. Essentially ALL the packets are passing through the “firewall” unhindered, the resets are just being used to target and force the endpoints to drop “unwanted” connections.

From the article…

Ignoring resets is trivial to achieve by applying simple firewall rules… and has no significant effect on ordinary working. If you want to be a little more clever you can examine the hop count (TTL) in the reset packets and determine whether the values are consistent with them arriving from the far end, or if the value indicates they have come from the intervening censorship device. We would argue that there is much to commend examining TTL values when considering defences against denial-of-service attacks using reset packets. Having operating system vendors provide this new functionality as standard would also be of practical use because Chinese citizens would not need to run special firewall-busting code (which the authorities might attempt to outlaw) but just off-the-shelf software (which they would necessarily tolerate).

Of course, there are OTHER blocks that the Chinese government has on sites, but according to the writeup, these static blocks are more expensive (tedious) to setup and maintain. So this method would not work for everything.

Related Posts

Blog Traffic Exchange Related Posts
  • Ping not working? try ARP I'll confess to having a lot to learn about IP ethernet networking. I feel pretty comfortable with basic TCP/IP (v4), the concept of UDP vs. TCP ports, ICMP pings, etc... but ARP is something that I haven't dabbled much with. It is, of course, a layer that TCP depends on.......
  • SSH, Proxies (Proxy's?), Tor and Web Browsing For quite some time I've been making use of a dd-wrt modified linksys box on my home network as an openvpn endpoint so that when I'm out and about in the world, I connect the vpn, switch firefox to route through a squid proxy server on the home network and......
  • Network Security guide for the home or small business network - Part 7 - Wireless Networking OK - the last couple of entries got into some heavy lifting and some real learning on your part. Learning about what software needs to run, what services are running, updating them to keep current on security patches. We even talked about securing services listening for outside connections and limiting......
Blog Traffic Exchange Related Websites
  • Types of Wireless Attacks Standard wireless communication occurs when the end user and the wireless access point are able to communication on a point-to-point basis without interruptions. There are many attack variations in existence against wireless networks that breaks the standard communication format. These attacks includes the denial of service attacks, the man in......
  • The Key Advantages Of Using The Article Submission Service For Your Website Article Submission Service is really a fresh and reliable way to improve awareness, create high quality in content back links, develop word-of-mouth and hence draw in target viewers for your site. By writing and submitting a quality article, you are not just telling your potential prospects about your service, but......
  • October Issue of BSD Magazine is Out! ARTICLES IN THIS ISSUE: iXsystems Announces Release of FreeNAS™ Version 8.0.1 Josh Paetzel Release features back end changes and bugfixes, as well as new front end user features More... Configuring a FreeBSD Stealth Logging Server Michael Shirk The collection of log files provides security administrators with the ability to have......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site