2026-spiderxss-tlshello-fragmentation-not

tlshello Fragmentation is not working in Iran anymore

@SpiderXss, @therealtunge · net4people/bbs · 2026

Abstract

A community report from August 2026 documenting Iran's new capability to detect and block fragmented TLS ClientHello packets, which previously allowed circumvention of SNI-based blocking by enabling CDN IP usage with both clean and blocked SNIs. The technique ceased functioning approximately late July 2026. Users confirm REALITY and ShadowSocks remain viable alternatives.

Team notes

Auto-ingested via corpus-crawl. Tags proposed by Claude Haiku 4.5; review and tighten before relying. Real-time signal of evolving Iranian middlebox capabilities; relevant for assessing robustness of fragmentation-dependent and alternative circumvention mechanisms.

Tags

censors: ir
techniques: middlebox-interference
defenses: reality shadowsocks

findings extracted from this paper

Iran's censorship infrastructure began dropping all fragmented TLS ClientHello packets around late July 2026, rendering the tlshello fragmentation bypass technique non-functional. The blocking took effect approximately July 27, 2026, based on user-reported timelines in the net4people/bbs community report.

Issue body (Jul 31 2026) detection dpisni-blockingmiddlebox-interference ir
Iran's fragmentation-detection capability targets the fragmentation mechanism itself, not the SNI field content: testers report blocking occurs even when the fragmented ClientHello carries a clean, non-blocked SNI. This indicates the censor is classifying flows by structural packet properties (fragment boundary patterns) rather than by inspected SNI value.

Issue body (Jul 31 2026) detection dpisni-blockingtraffic-shape ir
Community testing in Iran following the fragmentation bypass failure confirms that REALITY and Shadowsocks remain viable circumvention mechanisms as of late July 2026. Neither protocol relies on ClientHello fragmentation for evasion, which accounts for their continued functionality under the updated Iranian filtering regime.

Abstract / issue comments evaluation sni-blockingdpi ir