A MESA Lab research report systematically surveys the entire refraction-networking / decoy-routing lineage -- Curveball, Telex, Cirripede, TapDance, Rebound, Slitheen, Waterfall, Conjure, MultiFlow, SiegeBreaker, Gossip, Slitheen++ -- and for each assesses concrete traffic-identifiability weaknesses (TLS ClientHello tagging patterns, TCP-ISN covert registration, timing side-channels, up/down traffic-volume asymmetry) as a groundwork threat assessment, explicitly noting the analysis is still 'on paper' pending packet-capture validation against real deployments.
从相关系统的工作原理来看，一些系统具有可以区分的特征，如Telex、TapDance等的打标签的行为；一些系统需要在连接前与欺骗路由器注册...当然目前的分析都只是纸上谈兵，需要进一步的根据实际部署情况，通过抓包实践分析来进一步研究。
Defense implications
- MESA Lab already has a written weakness catalog for every major refraction-networking design (ClientHello-Random tagging, TCP-ISN registration signatures, asymmetric up/down traffic in Rebound-like schemes); a Lantern decoy-routing-style transport should assume these vectors are known and prioritize designs with no observable tagging/registration step.
- The report states MESA Lab believes TapDance is already used inside Psiphon/V2Ray/Trojan deployments -- worth checking against those projects' actual transport lists; if MESA Lab's belief is mistaken it's a gap in their intel, if correct those deployments are already on their radar.
Related findings
An internal MESA Lab presentation by a MESA Lab researcher (name/email redacted) describes 'CartoDNS', a global active/passive encrypted-DNS reconnaissance system that uses DNS-watermark injection across multi-region probing nodes to map DoT/DoH/DoQ resolver topology; as of the presentation it had discovered 80,000+ DoT, 20,000+ DoH and 4,000+ DoQ IPv4 resolvers (plus 1,100+ DoT and 500+ DoH over IPv6) and cataloged 500+ service providers with concrete IP ranges (Cloudflare, Google, Quad9, AdGuard, 360, Alibaba, Tencent, etc.), running continuously since December 2021.
A June 2024 internal MESA Team survey ('针对审查系统的科学研究及探测技术调研报告') catalogs the academic censorship-measurement toolkit (OONI, Augur, Satellite, Quack/Hyperquack, GFWatch, GFWeb, middlebox weaponization studies, traceroute-based middlebox localization, device fingerprinting) and separately reviews circumvention-tool countermeasures, explicitly naming Lantern alongside Psiphon, Tor Meek and Signal as tools using uTLS-style TLS ClientHello mimicry and domain-fronting.
An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.
The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author name redacted, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.
An internal TSG functional-requirements spec ('加密协议JG') defines device support for identifying and blocking ECH, ESNI and QUIC traffic via per-connection SNI/region-matching tables (e.g. DF_QUIC_REGION), plus a companion 'FD报文全流程感知' feature that both passively monitors and actively injects synthetic verification traffic end-to-end through the network path to compute a live per-rule 'CT率' (breakthrough/penetration rate) — the system self-measures how often its own QUIC/ESNI/ECH blocks fail to take effect, and separately throttles logging/blocking detail for rule IDs receiving unusually high hit counts (DF_ATTACK_PROTECTION, 'targeted attack detection').
An internal MESA Lab report (2021-06-25) documents a live test in which a second sapp instance ('sapp B') receives fully decrypted plaintext HTTP traffic via a Unix domain socket from a third-party TLS decryption platform, while sapp A separately captures raw ciphertext via the mrzcpd driver. 24 hours of the decrypted logs (319,569 HTTP records) show the top intercepted destinations are Facebook, Twitter, Google/YouTube and Instagram, with client IPs traced to residential China Telecom/Unicom/Mobile subscribers in Guangdong, Zhejiang and other provinces.