FINDING · DETECTION

After a Tor client inside China connected to a US-based bridge, that bridge subsequently received a series of Tor connection-initiation messages from different Chinese hosts — consistent with GFW active probing triggered by the initial client connection. The probe burst was followed by loss of the original client connection, demonstrating a two-phase detect-then-block pattern: passive identification of suspicious traffic triggers active re-probing to confirm the protocol before blocking.

From 2012-moghaddam-skypemorph — SkypeMorph: Protocol Obfuscation for Tor Bridges · §1 · 2012 · Computer and Communications Security

Implications

A pluggable transport must be robust against active probes: if the bridge responds to probe connections with Tor protocol bytes (or any non-cover-protocol bytes), the censor can confirm and block it regardless of how well the original client traffic was obfuscated.
Bridges should behave identically whether the incoming connection is a legitimate SkypeMorph client or a censor probe — i.e., require a valid cover-protocol handshake before revealing any Tor behavior.