A MESA Lab thesis/report states that ESNI/ECH protocol-identification technology, based on TLS extension field type numbers, "has already been applied in actual projects," and lists the researcher's own project participation as "G1系统 - ESNI、ECH加密协议识别" (Feb-Aug 2023) and "G1系统 - QUIC协议旁路ZD" (Feb-Nov 2023, QUIC bypass/blocking), plus a separately implemented "DNS主动探测模块" (DNS active-probing module, marked 已实现/already implemented). "G1" also appears independently as a named legacy system in the Maat/Transformer DPI header (PROTO_VPN comment: "G1历史遗留"), corroborating it as a real internal system name, not a typo.

An internal TSG functional-requirements spec ('加密协议JG') defines device support for identifying and blocking ECH, ESNI and QUIC traffic via per-connection SNI/region-matching tables (e.g. DF_QUIC_REGION), plus a companion 'FD报文全流程感知' feature that both passively monitors and actively injects synthetic verification traffic end-to-end through the network path to compute a live per-rule 'CT率' (breakthrough/penetration rate) — the system self-measures how often its own QUIC/ESNI/ECH blocks fail to take effect, and separately throttles logging/blocking detail for rule IDs receiving unusually high hit counts (DF_ATTACK_PROTECTION, 'targeted attack detection').

An internal experiment using BurpSuite as a MITM proxy tests injecting a forged QUIC ServerHello carrying a connection-close frame ahead of the real server response, to make the client abandon its QUIC handshake; the author separately proposes recording every site known to support QUIC and simply blocking plain TCP connections to those sites, on the theory that this indirectly forces QUIC off since a censor cannot otherwise tell in advance which TCP flow would have upgraded to QUIC.

The MESA_Platform/gquic sapp plugin extracts SNI and User-Agent across a wide range of QUIC implementations/versions (Google QUIC 23/25/33/34/35/37/39/41/43/44/46/48/50, IETF QUIC draft-29 and RFC9000, plus QUANT/PicoQUIC/quic-go/quicly/MsQuic/mvfst/TQUIC), including a dedicated Aug 2021 feature to 'support parsing encrypted SNI for QUIC RFC9000' — i.e. the DPI engine derives/decrypts QUIC Initial-packet protection to recover the TLS ClientHello SNI even from RFC9000's protected header.

An internal MESA Lab presentation by a MESA Lab researcher (name/email redacted) describes 'CartoDNS', a global active/passive encrypted-DNS reconnaissance system that uses DNS-watermark injection across multi-region probing nodes to map DoT/DoH/DoQ resolver topology; as of the presentation it had discovered 80,000+ DoT, 20,000+ DoH and 4,000+ DoQ IPv4 resolvers (plus 1,100+ DoT and 500+ DoH over IPv6) and cataloged 500+ service providers with concrete IP ranges (Cloudflare, Google, Quad9, AdGuard, 360, Alibaba, Tencent, etc.), running continuously since December 2021.

A WWW 2024 paper co-authored by MESA Lab's PI (MESA Lab PI, IIE-CAS (name redacted)) presents VPNChecker, a graph-based active-probing VPN-server detector modeling cross-port probe-response behavior; the paper states VPNChecker was deployed and evaluated inside a real ISP's network as a complement to existing detection engines, and documents concrete multi-port active-probing signatures for many commercial VPN/circumvention tools (e.g. Psiphon3: {22,53,443}, {22,443,554}, {22,53,443,554}).

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.