The great firewall of China



The great firewall of China may be just an illusion in technical terms. This article describes the details of how things work…. Basically when “banned content” is detected, both ends of the connection are sent a flood of tcp reset packets. Which (if both sides are designed to pay attention to) means that the two computers “hang up” assuming the other side reset the connection. But, while most current PC operating systems obey the reset packets…. it’s not something that is imperative. (You might think of this as a targeted/surgical denial of service attack using TCP reset packets…) The article goes a bit deeper though….


What if the pcs ignored reset packets…. yes they could. There’s no rule that a tcp stack HAS to obey a reset packet. IF the packets were ignored the firewall would turn out to be nothing more than an illusion technically speaking. Because the pcs on either end would continue communicating. Essentially ALL the packets are passing through the “firewall” unhindered, the resets are just being used to target and force the endpoints to drop “unwanted” connections.

From the article…

Ignoring resets is trivial to achieve by applying simple firewall rules… and has no significant effect on ordinary working. If you want to be a little more clever you can examine the hop count (TTL) in the reset packets and determine whether the values are consistent with them arriving from the far end, or if the value indicates they have come from the intervening censorship device. We would argue that there is much to commend examining TTL values when considering defences against denial-of-service attacks using reset packets. Having operating system vendors provide this new functionality as standard would also be of practical use because Chinese citizens would not need to run special firewall-busting code (which the authorities might attempt to outlaw) but just off-the-shelf software (which they would necessarily tolerate).

Of course, there are OTHER blocks that the Chinese government has on sites, but according to the writeup, these static blocks are more expensive (tedious) to setup and maintain. So this method would not work for everything.

Related Posts

Blog Traffic Exchange Related Posts
  • Network Security guide for the home or small business network - Part 6 - Secure your services This one is going to be tougher. Of what we've looked at so far this will probably take more work and learning than any of the others. The good news is, depending on your situation you may need to do less here. IF you have decided that your pc (or......
  • Ping not working? try ARP I'll confess to having a lot to learn about IP ethernet networking. I feel pretty comfortable with basic TCP/IP (v4), the concept of UDP vs. TCP ports, ICMP pings, etc... but ARP is something that I haven't dabbled much with. It is, of course, a layer that TCP depends on.......
  • UDP problem... I found a peculiar problem while I was setting up an openvpn link the other day. The goal was a simple shared key setup and I started with the sample configuration and modified it a bit to fit the circumstances, I allowed the correct UDP port through the firewall (I......
Blog Traffic Exchange Related Websites
  • Ideas for Blogging Content Pt 1 Business blogging is rife with benefits for those who utilize it properly, as it adds significant value to a company's web presence, increasing search engine visibility and encouraging excellent and meaningful interaction from readers, driving an increase of traffic to your website in the process. But blogging for business is......
  • The Key Advantages Of Using The Article Submission Service For Your Website Article Submission Service is really a fresh and reliable way to improve awareness, create high quality in content back links, develop word-of-mouth and hence draw in target viewers for your site. By writing and submitting a quality article, you are not just telling your potential prospects about your service, but......
  • October Issue of BSD Magazine is Out! ARTICLES IN THIS ISSUE: iXsystems Announces Release of FreeNAS™ Version 8.0.1 Josh Paetzel Release features back end changes and bugfixes, as well as new front end user features More... Configuring a FreeBSD Stealth Logging Server Michael Shirk The collection of log files provides security administrators with the ability to have......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site