TECHNIQUES
throttling Throttling / bandwidth shaping
Censor degrades a flow's throughput rather than blocking it outright.
15 papers on file
- 2026-article19-tightening-the-net Tightening the Net: China's Infrastructure of Oppression in Iran
- 2026-ermao-april-airport-outage 2026年四月机场断线潮详解：通报、拔线与涨价预期下，普通用户该怎么应对 / Anatomy of the April 2026 China VPN-Reseller Outage Wave
- 2026-gohoski-russia-possible-tun [Russia] Possible TUN detection on DPI level?
- 2026-molotoves-wall-behind-wall A Wall Behind A Wall : In Fujian
- 2025-aryapour-stealth-blackout Iran's Stealth Internet Blackout: A New Model of Censorship
- 2025-cloud206-myanmar-severe-internet [Myanmar] Severe Internet Slowdown & VPN Connectivity Issues (Since Nov 1st) - Firewall or Cable Issue?
- 2025-hyperion-cs-censor-has-new Censor has a new method of blocking
- 2025-its0ka-mobile-network-website Mobile network website whitelist
- 2025-miaan-stealth-blackout Iran's Stealth Blackout: A Multi-stakeholder Analysis of the June 2025 Internet Shutdown
- 2025-pereira-extended Extended Abstract: Traffic Shaping for Network Protocols: A Modular and Developer-Friendly Framework
- 2025-piotrowska-nym-iran-blackout Nym Report on Iran's Recent Internet Blackouts (June 2025): What it Means for Censorship Resistance and NymVPN
- 2021-xue-throttling Throttling Twitter: an emerging censorship technique in Russia
- 2020-zhu-characterizing Characterizing Transnational Internet Performance and the Great Bottleneck of China
- 2017-morshed-when When the Internet Goes Down in Bangladesh
- 2013-anderson-dimming Dimming the Internet: Detecting Throttling as a Mechanism of Censorship in Iran
53 findings tagged here
-
During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.
-
In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.
-
After the shutdown lifted (Scan 3), DNS-over-UDP degraded severely — 89.18% of the 9,000 queried domains were affected — but the paper attributes this to general UDP transport instability rather than domain-specific censorship, corroborated by GitHub user reports of ongoing UDP issues. TCP-based protocols (HTTP, TLS) returned to pre-shutdown censorship levels (~15%) in Scan 3, confirming the post-shutdown persistence effect was UDP-specific and not a broadening of the blocklist.
-
Iran's June 2025 shutdown was enforced using fine-grained, service-level techniques rather than BGP withdrawals or a single 'big switch' event: individual protocols were selectively blocked before and after the 7-day full blackout (June 18–25), with the total preparation and recovery periods each lasting roughly 4–5 days. Cloudflare Radar showed HTTP traffic reaching near-zero by June 18 but partial recovery already on June 21, while the authors' vantage point (AS57497) remained unreachable until June 25, confirming heterogeneous recovery across Iranian networks.
-
Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.
-
Article 19 documents that Iran combines technical filtering with formal coercion of major foreign platforms (including Telegram, Instagram, and WhatsApp) to comply with content removal orders under threat of full blocking. The report notes that Iran's 2022 Women Life Freedom protests accelerated platform blocking when foreign operators refused compliance, demonstrating that the censorship system operates in two modes: coerce-and-allow for compliant platforms, block for non-compliant ones. Domain fronting via these platforms is therefore subject to sudden revocation if political conditions change.
-
The report maps specific Belt and Road Initiative Digital Silk Road projects through which Chinese technology vendors have transferred censorship and surveillance infrastructure to Iran, including fiber backbone investments, data-center co-location agreements, and equipment supply chains. Specific vendors named include Huawei and ZTE as network infrastructure providers, with the report noting that equipment exports include filtering-capable hardware that Iran's ISPs have deployed at network choke points.
-
The April 2026 enforcement cycle created a resource-scarcity feedback loop: upstream providers cut lines with no obligation to refund resellers, newly acquired replacement resources can themselves be reported and cut within days, and stable-resource availability windows are described as "越来越短" (increasingly short) while costs rise concurrently. The overall effect is systemic capacity contraction forecast to continue through at least May 2026.
-
The detection event on Beeline (AS16345) exhibits a 5–15 minute delay between TUN activation and connection degradation onset, followed by a further delay before full blocking, consistent with a behavioral or statistical classifier rather than a signature-based real-time inspector. The graduated timeline (partial degradation → near-total block) suggests a threshold-based scoring system rather than an immediate signature match.
-
After the detection event triggers on Beeline (AS16345), the connection is restricted to exactly one destination: the government-approved MAX messenger (max.ru), while all other Russian domestic whitelist domains (ok.ru, vk.ru, ya.ru, mail.ru) are also blocked. This response is enforced at the ISP/TSPU level and persists until the LTE router is restarted, indicating a stateful per-subscriber penalty state rather than simple packet-level blocking.
-
Community respondents explain that the proposed 回国VPN exploitation strategy fails because the GFW monitors all outbound connections from Chinese data centers regardless of the tunnel mechanism used. The legitimacy of the outer 回国VPN service does not confer immunity to GFW inspection on the outbound path.
-
A proposed circumvention technique nests an outbound tunnel inside a legitimate 回国VPN (return-to-China service): the China-IP endpoint of the outer tunnel acts as a relay, with a VPS outside China pushing data back through it in reverse. The theoretical benefit is that 回国VPN services are officially permitted and reportedly not throttled by the GFW.
-
回国VPN services are legitimate commercial products designed to give Chinese diaspora enterprises access to Chinese-hosted services, creating tunnels inbound from the open internet to servers inside China. Their legitimacy and preferential GFW treatment are directionally specific — they are sanctioned for inbound-to-China use, not for outbound circumvention.
-
BitTorrent (qBittorrent) experiences asymmetric throttling in Fuzhou: connections to peers in Russia are severely impaired while connections to peers within mainland China remain normal, indicating selective cross-border flow throttling rather than protocol-level blocking.
-
For non-whitelisted SNIs connecting to allowed Cloudflare IPs, Iran's DPI enforced a strict 6-packet limit per connection, sufficient only to load a webpage but not to sustain any tunnel; connections bearing a whitelisted SNI were unrestricted. Outside DNS providers were blocked within one to two weeks and replaced with a local DNS infrastructure that operated at a maximum of ~100 KB/s with connections dropping at approximately the one-minute mark.
-
Russia's TSPU (Технические средства противодействия угрозам) is the national censorship infrastructure operated by Roskomnadzor, deployed inline at Russian ISPs. Technical documentation of its architecture and operating principles has been made publicly available via YouTube presentations by Russian-language researchers. The system is evidently not classified, so circumvention researchers can study its detection logic from these materials rather than relying solely on empirical measurement; a 2021 presentation documents TSPU performing in-path filtering and traffic redirection rather than relying on endpoint-level DNS alone.
-
Beginning November 1st, 2025, Myanmar users reported severely asymmetric internet speeds: download speeds were near-unusable while upload speeds remained at normal maximum capacity, a pattern inconsistent with submarine cable faults which typically degrade both directions.
-
Community technical analysis of the November 2025 Myanmar disruption concluded the observed symptom cluster — unidirectional throttling, rapid VPN IP blocking, and selective service allowlisting — is inconsistent with submarine cable faults and instead indicates deployment of new national-level traffic filtering infrastructure, consistent with GFW-derived Geedge filtering technology previously documented in Myanmar.
-
Champa implements adaptive request-rate control: when the AMP cache returns an unexpected response (e.g., HTTP 302), the client halves its polling rate. Once the polling interval exceeds one second the client is considered fully rate-limited and must restart after a multi-hour cooldown. This mechanism keeps the client from burning through its allowance when cache responses degrade.
-
Champa's AMP-cache tunnel delivers at most ~15 KB/s throughput before AMP rate-limiting activates. Sessions last approximately 15 minutes before the rate limit triggers; after that, users must stop the client and wait several hours before resuming.
-
The report documents that Myanmar's military has used its TSG-based infrastructure to execute targeted throttling and selective shutdowns of specific services and platforms, not only blanket internet shutdowns. This includes selective disruption of VPNs and circumvention tools during periods of civil unrest, demonstrating that Myanmar's censors have operationalized the granular per-service traffic control capabilities documented in the Geedge/MESA leak.
-
Psiphon's multi-protocol design maintained access for approximately 1.5 million users during the June 2025 Iran shutdown — roughly one-third of its normal user base — while traffic throttling rendered many single-protocol circumvention tools functionally useless for anything beyond basic text communication.
-
Between 21–25 June 2025, Iranian fixed-line networks partially restored access via TCP-based protocols (SSH, WebSockets) while mobile networks and UDP-based protocols remained heavily restricted, indicating deliberate asymmetric enforcement to restore domestic data-center operation without re-enabling VPN circumvention.
-
Active mid-connection bandwidth throttling (e.g., 100 Mbps → 50 Mbps) cleanly separates BBR from Hysteria and TCP-Brutal: BBR converges to the new rate within a few probing cycles, while Hysteria and Brutal interpret reduced bandwidth as increased packet loss and raise their sending rate further. This active probing technique resolves the BBR ambiguity that passive measurement alone cannot.
-
Geedge co-founder Fang Binxing—named 'father of the Great Firewall' in company documents—explicitly linked Geedge's international expansion to China's Belt and Road Initiative in a 2024 speech, and a Geedge job advertisement sought candidates willing to travel to Pakistan, Malaysia, Bahrain, Algeria, and India. This confirms BRI as an institutional channel for GFW-derived censorship infrastructure export, not merely bilateral commercial deals.
-
A September 2025 leak of 100,000+ internal documents from Geedge Networks—co-founded by Great Firewall architect Fang Binxing—confirms export of GFW-derived Tiangou Secure Gateway (TSG) to Myanmar, Pakistan, Ethiopia, and Kazakhstan, providing those governments with DPI-based filtering, throttling, VPN blocking, and internet-blackout capabilities previously unavailable to them. Pakistan's deployment replaced Sandvine's Web Monitoring System infrastructure after Sandvine was sanctioned and exited in 2023, with Geedge apparently utilizing existing Sandvine hardware. Kazakhstan was the first client, from 2018, and Geedge claims more than 40 global service providers as clients under the Belt and Road Initiative framework.
-
TSPU devices perform in-line packet manipulation — they can inject RST packets, drop traffic, and throttle connections — rather than routing traffic to an out-of-band sniffer that votes to block. The inline placement means TSPU can act on the first-packet payload and impose latency on all matching flows, not only on those selected by sampling. Blocking decisions are therefore applied with high recall at the ISP edge, and circumvention tools that rely on short observation windows (e.g. only obfuscating the first N bytes) are vulnerable to continued inline inspection of subsequent traffic.
-
Across all years of the KIO dataset (2016–2021), a large majority of events involved full-network shutdowns and their count grew significantly from 2016 to 2019 with no significant decline observed through 2021. Censors are also increasingly employing app-specific bans and throttling alongside full shutdowns, with all three restriction categories non-mutually exclusive and rising over the period.
-
An adversary introducing audio perturbations every 2.5 seconds (sufficient to corrupt each 20-byte chunk at 64 bps) degrades PESQ call quality to 1.6, below the 2.0 'unusable' threshold, making the attack self-defeating. However, targeting only acknowledgment windows (every ~12.5 s under Dolphin's default batch-of-5 configuration) achieves PESQ 3.6 — acceptable to human callers — while fully disrupting Dolphin data transfer.
-
The Lox check-blockage protocol response size and time grow linearly with the number of blocked bridges — 6 kB / 11 ms at 5% blocked, 63 kB / 64 ms at 50%, and 126 kB / 122.5 ms at 100% — creating a bandwidth bottleneck a strategic and patient censor can exploit by triggering mass bridge blockages during a critical event (election, coup) to deny successful blockage migrations at the moment users most need them.
-
Protozoa's covert channel throughput degrades gracefully under bandwidth constraints but remains usable for common applications: average throughput is 975 Kbps at 1500 Kbps cap, 460 Kbps at 750 Kbps, and 91 Kbps at 250 Kbps. Under 2% and 5% packet loss the channel sustains 1130 Kbps and 360 Kbps, respectively, while 10% loss (near WebRTC tear-down threshold) still yields 160 Kbps without breaking the connection. Traffic analysis resistance is preserved across all these conditions, with AUC peaking at 0.65.
-
In Iran in 2013, censors dropped or throttled certain TCP connections after 60 seconds, severely disrupting circumvention protocols like obfs4 that fuse session state with a single long-lived TCP connection, while short-lived HTTP connections were largely unaffected. obfs4 has no session concept independent of the underlying TCP connection; when that connection is terminated, all end-to-end state is lost and a new session must restart from scratch.
-
Hop-by-hop bottleneck localization showed that in more than 71% of measured paths the first lossy hop is located deep inside China (beyond the border), with only 34.45% of bottleneck hops coinciding with the GFW hop as detected by RST injection probing — suggesting Chinese ISP infrastructure underprovisioning rather than GFW intervention as the primary cause.
-
The bottleneck exhibits strong and consistent diurnal patterns: 80–95% of receiver–sender pairs show a standard deviation of less than 3 hours in daily slowdown duration, and the patterns persist unchanged across weekends and national holidays (May 1–2 and October 1 national day). Packet loss is strictly asymmetric — occurring only for traffic entering China (inbound data and outbound ACK packets), not for traffic leaving China.
-
The Great Bottleneck of China affects 79% of measured receiver–sender pairs, with more than 70% of those pairs suffering throughput below 1 Mbps for more than 5 hours every day. M-Lab NDT data independently corroborates this: in 64% of 75,464 tests from China, download speed was below 500 kbps.
-
Hong Kong is the sole geographic exception: it experiences no measurable slowdowns when accessing the foreign Internet, and Chinese mainland receivers accessing Hong Kong as a sender averaged only ~3 hours of slowdown per day — compared to 5–17 hours for US, European, and most Asian senders — making it an effective high-performance relay between mainland China and the rest of the world.
-
A/B testing across HTTP, HTTPS, VPN, and Shadowsocks traffic found no measurable difference in packet loss rates, ruling out censorship-targeted protocol throttling as the cause. Even at probe rates as low as one packet per 10 seconds, loss rates were similar across all protocol variants, indicating no per-connection or per-protocol speed throttling by the GFW.
-
The GFW's robustness depends principally on suppressed citizen demand for uncensored information, not solely on access barriers. Calibration shows censorship remains stable even if the unencouraged access rate were substantially expanded, because low demand and moderate social transmission prevent information from reaching population-wide tipping points. However, censorship is fragile to demand stimulation: scaling the encouragement intervention to all students would, per the model, inform the entire student population.
-
Across eight combinations of traffic features (packet length, bi-gram packet length, inter-packet time, bi-gram inter-packet time) and two similarity metrics (EMD, KS), adversarial classification accuracy against DeltaShaper streams ranges from 72–90% in unperturbed conditions. Bi-gram inter-packet times with EMD achieves 88% accuracy, matching packet-length/EMD, but requires roughly 10x the computation (~64s vs ~6s). Bandwidth throttling to 300 Kbps degrades classifier accuracy from 88% to 75%, but also drops Skype frame rate from 30 to 5 FPS, creating collateral damage that limits censor deployment of throttling as a detection aid.
-
Tor usage in Turkey spiked sharply during the initial days of the July 2016 coup—when ISPs were actively throttling Twitter—but declined steadily in subsequent months back toward pre-coup baselines, consistent with post-coup suppression being driven by chilling effects rather than sustained network-level blocking.
-
Comparing 5.6M pre-coup tweets (2015 Turkish general election) to 8.5M post-coup tweets (July–November 2016), the authors found 72% fewer government-censored tweets post-coup (142,492 vs. 513,719), with an estimated 43% of that decline attributable to reduced overall Twitter usage in Turkey and the remainder to user self-censorship.
-
Anderson's analysis of Iran's network connectivity from January 2010 to 2013 uncovered two extended throttling periods with 77% and 69% decreases in download throughput respectively, plus eight to nine shorter periods; these often coincided with holidays, protest events, international political turmoils, and important anniversaries.
-
Under degraded network conditions, CovertCast page load times increased by 2–3× at 800 Kbps (below YouTube's minimum 720p bitrate of 1.5 Mbps), with 20 of over 4,000 images dropped at 800 Kbps; at 10% packet loss, 35 images were missed due to YouTube temporarily accelerating video playback; at 20% packet loss, 720p video could not be loaded at all.
-
The survey identifies 'soft censorship' — including throttling, packet-loss injection, and quality-of-experience degradation — as detected by only 2 of 13 surveyed platforms (rTurtle and UBICA) as of 2015. The paper explicitly flags this as a measurement gap, noting that soft censorship symptoms are indistinguishable from ordinary network congestion without ground-truth probes placed outside the censor's network.
-
Throughput variance across Iranian ISPs collapsed nearly simultaneously during suspected throttling events, consistent with a centrally-coordinated administrative order rather than independent ISP-level decisions. Former ISP staff accounts cited in the paper indicate throttling orders were delivered by phone or fax, with smaller regional providers potentially delaying compliance—implying a brief window before universal enforcement.
-
Throughput drops correlated directly with political mobilizations: the 2012-02-14 anniversary of political detentions registered a -102.9% weekly-minimum change relative to the two-month mean, and the October 2012 currency protests showed a -86.2% weekly minimum. Round-trip time did not increase proportionally during these drops, distinguishing them from ordinary congestion.
-
Using M-Lab NDT measurements from Iran, the paper identifies two extended throttling periods: November 30, 2011 – August 15, 2012 (77% decrease in median download throughput) and October 4 – November 22, 2012 (69% decrease), plus 8–9 shorter-term disruptions. Weekly variance analysis yields even steeper figures of -98% and -82% for the two major events.
-
During the November 2011 throttling event, every Iranian ASN under consideration experienced more than a 74% drop in throughput within the first two months; only one prefix (ITC's commercial hosting block 80.191.96.0/19) showed an increase. Academic networks (Sharif University AS12660, University of Tehran AS29068) recovered faster than consumer ISPs, suggesting selective prioritization or exemption for institutional traffic.
-
Iran's censors preferred throttling over outright shutdown because it is less conspicuous and draws less controversy. The paper notes that NDT-style bulk-transfer tests cannot detect targeted, DPI-based throttling of specific protocols (VPN, Tor, streaming), since those present different traffic signatures than generic TCP bulk transfers. Iran's filtering infrastructure (TCI/ITC, AS12880) runs deep packet inspection as an auxiliary layer on top of ISP-level controls.
-
SSH transfers utilized only 15% of available bandwidth versus 85–89% for HTTP/HTTPS. When SSH was obfuscated by XORing payloads with a constant key (hiding the plaintext handshake), throughput dropped to near-zero during all trials. Applying the same obfuscation to HTTP transfers produced the same near-zero result, supporting the hypothesis that Iran whitelists known-approved protocols rather than blacklisting specific ones, which would preemptively block any unrecognized or randomized transport including Tor's obfsproxy.
-
Graduated censorship — limiting the suppression rate to remain within the typical weekly variance band — evades the weekly-interval detector entirely. The paper acknowledges that detecting slow-ramp blocking requires extending the observation window beyond seven days.
-
Iran and Libya each have a single point of control (1 AS), making complete national internet shutdown achievable with a single administrative action. Egypt's 2011 shutdown left one AS (Noor Group, 4.9% of connected IPs) operational for four days, apparently due to its role serving the Egyptian stock exchange and other core financial institutions.
-
The U.S. 'five strikes' program had major ISPs reduce bandwidth of accused subscribers; challenging required a $35 fee with only one permitted defense category ('unauthorized use of account'). Users responded by routing traffic through VPNs and anonymizing networks such as I2P to bypass ISP-level monitoring entirely.