Approximately 10% of China's IP addresses respond to IPID probes, and 13% of those exhibit globally incrementing IPIDs, meaning roughly 1% of China's total IP address space can serve as passive measurement vantage points with no cooperation from host owners. In contrast, Tor bridge blocking from Chinese clients was observed in 58.91% of server-to-client cases versus 0% for non-China Asia-Pacific clients.

The GFW blocks Tor primarily via stateless SYN/ACK dropping based on the server's source IP address and port (server-to-client direction, 73.04% of CN,Tor-dir cases). Two specific Tor directory authorities account for 98.8% of client-to-server (null-routed) blocks and 72.7% of error cases, indicating selective deeper blocking of specific IP addresses beyond the common return-path filter.

§5 detection

Over 5 days of measurement, 73.04% of connections from Chinese clients to Tor directory servers were blocked server-to-client (stateless SYN/ACK dropping), 16.73% were blocked client-to-server (null routing), and only 0.63% were unblocked. Of all censored Tor directory server connections measured across all regions, 98% originated from Chinese clients.

§5, Table 1 evaluation

Using TCP IPID side channels combined with SYN backlog state inference, the authors detect intentional packet drops between two arbitrary Internet hosts without controlling either host. The only requirements are a client with a globally incrementing IPID (~1% of IP space) and a server with an open port; an ARMA model handles autocorrelated noise.

§2 evaluation

Client-to-server packet drops (RSTs from client to server are dropped in transit) indicate the simplest null-routing mechanism: the server's destination IP is null-routed at the censor. The method distinguishes this from server-to-client drops (stateless return-path filtering) and from RST/ICMP injection—cases where the packet is not dropped but a forged termination packet is inserted—which both appear as the 'no-packets-dropped' outcome in the IPID time series.

§2 detection

'Resource Inaccessible' was the most frequently reported issue (61% of 119 submitted reports) during a month of naturalistic Tor Browser browsing, followed by CAPTCHAs (18%), Broken Content (17%), Other Issues (13%), and Timeouts (5%). These categories document the operational failure modes that degrade everyday Tor Browser usability beyond protocol-level censorship.

2026-micallef-reportor-facilitating-user §6.1, Figure 3 ip-blockingmeasurement-platform

IODA Active Probing shows Iran's global Internet connectivity dropped to approximately 3% on February 28, 2026, and had not recovered as of the report date (59+ days). This matches the near-3% floor seen during the January 2026 protests shutdown, establishing a repeatable operational baseline for the regime's tiered blocking posture.

2026-wkrp-internet-pro-tiered IODA Data: The Discrepancy in the Signals measurement-platformip-blocking

IODA telescope and Google Product signals, corroborated by Cloudflare Radar and Kentik traffic data, show selective whitelist restoration: Google Search and Images are accessible via the NIN while Google Maps is not, and IranCell (AS44244) shows a slight diurnal Telescope traffic increase consistent with 'Internet Pro' access—demonstrating that selective per-service and per-ASN whitelisting is operationally active.

2026-wkrp-internet-pro-tiered IODA Data: The Discrepancy in the Signals ip-blockingmeasurement-platform

During the June 2025 Israel-Iran war, IODA observed that BGP routing announcements remained largely intact while Active Probing and Telescope signals showed a near-total Internet blackout—a 'stealth blackout' technique that hides shutdown actions behind maintained routing infrastructure. This pattern was replicated in the February 28, 2026 shutdown, where Active Probing dropped to ~3% while BGP remained stable.

2026-wkrp-internet-pro-tiered The New Normal in Comparative Perspective ip-blockingmeasurement-platform

Cloud-hosted services represent an open measurement problem for ZMap because IPs are shared, ephemeral, and behind CDN layers, making traditional IP-to-service attribution unreliable. The paper identifies reconciling scan-based observation with cloud infrastructure as a key challenge for the next decade.

2024-durumeric-ten-years-zmap Abstract — open problems measurement-platformip-blocking

IPv6 measurement remains an open problem for ZMap because the address space is too large for exhaustive single-packet enumeration, unlike IPv4. This asymmetry means IPv6-addressed infrastructure is structurally harder to enumerate via blocklisting.

2024-durumeric-ten-years-zmap Abstract — open problems measurement-platformip-blocking