0

BBC news is censored in the country where I live. Out of interest I decided to briefly look at how this is done.

First of all they apparently MITM DNS - if I look up BBC domains on Google's 8.8.8.8 I get this:

block. 900 IN SOA <removed>. please_set_email.absolutely.nowhere. 164 10800 3600 2419200 900

(I've <removed> part of the record as it explicitly names the country I'm in).

Anyway I can get around this by just switching to Cloudflare's 1.1.1.1. So let's see what happens when we try to connect (tcpdump output):

14:06:58.458843 IP my-hostname.54110 > 151.101.76.81.https: Flags [S], seq 1689507390, win 29200, options [mss 1460,sackOK,TS val 3566331804 ecr 0,nop,wscale 7], length 0
14:06:58.510201 IP 151.101.76.81.https > my-hostname.54110: Flags [S.], seq 1058793439, ack 1689507391, win 27800, options [mss 1402,sackOK,TS val 1280682927 ecr 3566331804,nop,wscale 9], length 0
14:06:58.510300 IP my-hostname.54110 > 151.101.76.81.https: Flags [.], ack 1, win 229, options [nop,nop,TS val 3566331855 ecr 1280682927], length 0
14:06:58.514567 IP my-hostname.54110 > 151.101.76.81.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 3566331860 ecr 1280682927], length 517
14:06:58.767916 IP my-hostname.54110 > 151.101.76.81.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 3566332113 ecr 1280682927], length 517
14:06:59.023960 IP my-hostname.54110 > 151.101.76.81.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 3566332369 ecr 1280682927], length 517
14:06:59.533120 IP 151.101.76.81.https > my-hostname.54110: Flags [S.], seq 1058793439, ack 1689507391, win 27800, options [mss 1402,sackOK,TS val 1280683184 ecr 3566331855,nop,wscale 9], length 0

To my relatively inexpert eyes, that reads as:

  1. I send SYN
  2. BBC sends SYN,ACK
  3. I send ACK
  4. I start trying to set up TLS, get no response
  5. BBC retransmits its SYN,ACK
  6. (I didn't include any more trace, but 3-5 then repeat for a while)

So, apparently my ACK in part 3 is not getting through.

So I'm just curious - why would the ISP allow the SYN packets through but not the rest? Why not just block all IP traffic to the given address? Is it possible that they are just specifically blocking my ACK from part 3 (I have no way of knowing if my TLS hello in part 4 got through, right?)? Is there anything else we can learn from this?

Improve this question
2
  • 2
    Only networks that are under your full control are on-topic here, your ISP network isn't. Check the help center for details.
    – Zac67 ♦
    Jul 30, 2019 at 9:10
  • Each ISP does things differently. Only someone working for your ISP could say for sure, but they probably will not talk about it. We can only guess or speculate, and that is off-topic here.
    – Ron Maupin ♦
    Jul 30, 2019 at 11:46

1 Answer 1

Reset to default
3

In general, your ISP will use DPI(Deep packet inspection) techniques, check HTTP.Host parameters, check destination IPs, check SSL.Server names and many more.

Improve this answer
1
  • +1 and in addition to your answer, the "new" thing, that Next Generation Firewalls perform is checking traffic and packet patterns for certain applications which eliminates the need to use CPU for inspecting the traffic.
    – Cow
    Jul 30, 2019 at 10:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.