China's censoring devices send four spoofed RST packets per filtered connection with varying sequence and ACK numbers and TTL values corresponding to roughly the hop count to the Chinese border; the IP ID field increments sequentially per TTL group, strongly implying a small cluster of out-of-band machines co-located at each border router. Because the device is out-of-band, the actual server response still arrives at the client but is preempted by the injected RSTs.
From 2012-verkamp-inferring — Inferring Mechanics of Web Censorship Around the World
· §4.2
· 2012
· Free and Open Communications on the Internet
Implications
Implement RST-ignoring at both client and server endpoints — the out-of-band injector cannot suppress the real server response, so discarding non-authentic RSTs recovers the original reply.
Use TTL and sequential IP-ID analysis to fingerprint injected RSTs as distinct from legitimate ones, enabling selective filtering in circumvention clients.