mothran/mongol — pull request #3 by fqrouter (2013-02-06 16:44:17+00:00)
Title: Demo of probe GFW router using 3 ways

This is demo of how to probe GFW using different ways. Under the hood, they all are based on TTL. If TTL is high enough to reach GFW attached router, we can observe 3 different phenomenon, being:
* TCP RST sent back
* FAKE DNS ANSWER sent back
* NOTHING even ICMP not sent back

Besides there are two important usage scenario need to take into consideration:
* Host forbid sending packet via raw socket (but you can capture packet using raw socket). Namely OpenVZ container using venet network adapter, which is common for the VPS we use to host VPN.
* Host behind NAT, which requires SYN+ACK sent back before further communication.

So, inside the demo there are 2 groups of probes. One being compatible, which sends all packets using normal UDP or TCP packet. Another being direct, which sends whatever packet we want using raw socket. Except for direct_probe/tcp_rst.py, all probes should be working behind NAT (except NAT is not being nice with ICMP TTL EXCEEDED).

The hope of this demo is to identify a rough picture of how GFW is being deployed. Not just geographically, but also the correlation between different jamming methods being used. Such as we can observe some route will have both TCP RST and FAKE DNS ANSWER, but some route does not have FAKE DNS ANSWER deployed. Nearly all routes will drop packets orginated from blocked port consistently, except for the some routes served by China Mobile. By repeating the probing from different locations to different locations, certain pattern start to emerge. We know GFW is not just one thing, it is distributed, but also connected. By observing the data we collected, we might able to tell how many distributed clusters are there working independently. And how connected are those clusters.

There are certainly more works required to do, much more than a toy like demo. The focus should be on how we collect store and analyze packets to draw some useful conclusion. Probing is actually the easy part.

In the end, thanks flyes to @chemhack for providing resources necessary to carry the experienments.