Iran and Kazakhstan reset the residual censorship timer whenever the censor observes any matching packet from the victim, so TCP retransmissions from the victim's own stack inadvertently extend the blocking window far beyond the nominal 120–180s. China's HTTP residual censorship has only ~50% per-request reliability from some vantage points due to heterogeneous GFW middlebox load-balancing, but reliability plateaus near 100% after 7 repeated censorship triggers sent ahead of time.
From 2021-bock-your — Your Censor is My Censor: Weaponizing Censorship Infrastructure for Availability Attacks
· §IV (timer reset), §IV (reliability), Fig. 2
· 2021
· Workshop on Offensive Technologies
Implications
Circumvention clients should implement immediate back-off (not exponential retry) on detecting a residual-censorship event: continued retransmissions on Iran/Kazakhstan reset the timer and turn the victim's own stack into an attack amplifier.
Detect the residual-censorship condition within 1–2 SYN timeouts and rotate to a new tuple before the TCP stack accumulates retransmissions; detecting early prevents self-reinforcement of the block.