What technique is my ISP using to censor web traffic? [closed]

Question

BBC news is censored in the country where I live. Out of interest I decided to briefly look at how this is done.

First of all they apparently MITM DNS - if I look up BBC domains on Google's 8.8.8.8 I get this:

block. 900 IN SOA <removed>. please_set_email.absolutely.nowhere. 164 10800 3600 2419200 900

(I've <removed> part of the record as it explicitly names the country I'm in).

Anyway I can get around this by just switching to Cloudflare's 1.1.1.1. So let's see what happens when we try to connect (tcpdump output):

14:06:58.458843 IP my-hostname.54110 > 151.101.76.81.https: Flags [S], seq 1689507390, win 29200, options [mss 1460,sackOK,TS val 3566331804 ecr 0,nop,wscale 7], length 0
14:06:58.510201 IP 151.101.76.81.https > my-hostname.54110: Flags [S.], seq 1058793439, ack 1689507391, win 27800, options [mss 1402,sackOK,TS val 1280682927 ecr 3566331804,nop,wscale 9], length 0
14:06:58.510300 IP my-hostname.54110 > 151.101.76.81.https: Flags [.], ack 1, win 229, options [nop,nop,TS val 3566331855 ecr 1280682927], length 0
14:06:58.514567 IP my-hostname.54110 > 151.101.76.81.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 3566331860 ecr 1280682927], length 517
14:06:58.767916 IP my-hostname.54110 > 151.101.76.81.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 3566332113 ecr 1280682927], length 517
14:06:59.023960 IP my-hostname.54110 > 151.101.76.81.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 3566332369 ecr 1280682927], length 517
14:06:59.533120 IP 151.101.76.81.https > my-hostname.54110: Flags [S.], seq 1058793439, ack 1689507391, win 27800, options [mss 1402,sackOK,TS val 1280683184 ecr 3566331855,nop,wscale 9], length 0

To my relatively inexpert eyes, that reads as:

1. I send SYN
2. BBC sends SYN,ACK
3. I send ACK
4. I start trying to set up TLS, get no response
5. BBC retransmits its SYN,ACK
6. (I didn't include any more trace, but 3-5 then repeat for a while)

So, apparently my ACK in part 3 is not getting through.

So I'm just curious - why would the ISP allow the SYN packets through but not the rest? Why not just block all IP traffic to the given address? Is it possible that they are just specifically blocking my ACK from part 3 (I have no way of knowing if my TLS hello in part 4 got through, right?)? Is there anything else we can learn from this?

Answer 1

In general, your ISP will use DPI(Deep packet inspection) techniques, check HTTP.Host parameters, check destination IPs, check SSL.Server names and many more.