TLS connections to blocked services (instagram.com, telegram.org) were terminated by TCP RST immediately after the client's ClientHello, before any certificate exchange, confirming SNI-based DPI that reads the plaintext SNI extension and aborts the handshake. HTTP filtering additionally matched Host headers and URL keywords case-sensitively, with injected HTTP 403 pages or TCP RST responses, and case-change evasions were sometimes effective.
From 2025-aryapour-stealth-blackout — Iran's Stealth Internet Blackout: A New Model of Censorship
· §4.2, §4.3
· 2025
· arXiv preprint (cs.NI)
Implications
Encrypted ClientHello (ECH/ESNI) directly defeats the SNI-based RST injection described here; circumvention tools should negotiate ECH where supported, or use HTTPS-tunneling approaches that never expose the true SNI to the censor's DPI.
The documented case-sensitivity in HTTP keyword filtering suggests Geneva-style packet manipulation (header-case transforms) can still evade some filtering rules, though this should be treated as a fragile bypass rather than a durable defense.