FINDING · EVALUATION

A DTLS fingerprinting script run on one full day of network traffic at Lawrence Berkeley National Laboratory found only 7 DTLS handshakes with 3 unique client fingerprints and 3 unique server fingerprints, suggesting there may not be enough naturally occurring WebRTC traffic to provide meaningful cover for a WebRTC-based circumvention system.

From 2016-fifield-fingerprintability — Fingerprintability of WebRTC · §5 · 2016 · University of California, Berkeley

Implications

Do not assume WebRTC prevalence alone prevents censors from blocking all DTLS flows; empirical cover-population size must be periodically revalidated across diverse vantage points before relying on it as a defense.
Consider whether the realistic base rate of WebRTC traffic at a given network vantage point is large enough to make wholesale blocking prohibitively costly to the censor.