[tor-bugs] #30500 [Circumvention/Censorship analysis]: Can the GFW still do DPI for "new" vanilla Tor?

[Tor Bug Tracker & Wiki]

#30500: Can the GFW still do DPI for "new" vanilla Tor?
-----------------------------------------------+--------------------------
 Reporter:  phw                                |          Owner:  (none)
     Type:  task                               |         Status:  assigned
 Priority:  Low                                |      Milestone:
Component:  Circumvention/Censorship analysis  |        Version:
 Severity:  Normal                             |     Resolution:
 Keywords:  gfw, china                         |  Actual Points:
Parent ID:                                     |         Points:
 Reviewer:                                     |        Sponsor:
-----------------------------------------------+--------------------------

Comment (by phw):

 Replying to [comment:4 arma]:
 > Replying to [comment:2 phw]:
 > > The research team I've been in touch with could not trigger active
 probing with tcis as the client and a netcat listener as the server. I
 suggested to use a bridge instead of a netcat listener, which resulted in
 active probing. This suggests that the GFW is also considering some
 information that's sent from the server to the client.
 >
 > It would be interesting, for posterity, for somebody (maybe somebody in
 this research team you speak of) to poke at the server-side of the
 handshake and figure out what exactly they're relying on to decide that
 it's a Tor bridge.
 [[br]]
 I encouraged them to have a look at it.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30500#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online