TSG can enumerate deduplicated client IPs accessing Psiphon3 per site over a time range, and previously applied a distinct client-side "punishment mechanism" (removed in a later TSG upgrade) beyond simply blocking the traffic. The E21 (Ethiopia) customer, represented by a China Electronics (中电) contact, discussed deploying Psiphon3 countermeasures selectively at PE and GGSN (mobile-core) nodes concentrated in the capital first, then consolidating IGW traffic elsewhere to extend coverage.
TSG目前可以统计各站点在一段时间范围内，访问过psiphon3的去重客户端IP数量...TSG升级后管控psiphon3和现场前几次测试管控psiphon3的区别，是去掉了对psiphon3客户端的惩罚机制
Defense implications
- TSG previously had a per-client punitive mechanism beyond blocking for detected Psiphon3 users (nature unconfirmed) — worth flagging for further investigation given the human-rights angle.
- Detection/countermeasure rollout is deliberately staged by node type (GGSN mobile-core first, PE second, IGW consolidation last) and geography (capital first) — client population outside first-wave nodes may see materially better circumvention success for a window after any change.
Related findings
Ethiopia customer (E21/E-site) explicitly requested TSG blocking be extended beyond the baseline (Psiphon 3) to a named list of commercial VPNs: Freegate, CyberGhost, Torguard, NordVPN, IPVanish, VPN Unlimited, ExpressVPN, Surfshark, Windscribe, Hotspot Shield, Ivacy, Atlas VPN, PureVPN, ProtonVPN, Norton Secure VPN. Engineering confirmed delivery of NordVPN and Hotspot Shield signatures with successful field tests.
Ethiopia (E21) customer specifically tested Melon VPN and Ultrasurf against TSG; Ultrasurf's frequently-rotating IPs required an updated signature (successfully blocked after update), while Melon VPN's connection succeeded but was non-functional for other reasons (not attributed to TSG blocking).
Side-by-side internal performance comparison across Xinjiang (China Mobile carrier deployment, hostname cmcc-xj-server1-sapp-244), Fujian (domestic), and Ethiopia (E21) explicitly references the same 'app_sketch_maat' diagnostic log format at all three sites, confirming the identical AppSketch app-fingerprinting stack is used for domestic Xinjiang surveillance and for the exported Ethiopia deployment.
Direct dated evidence (July 2023) that the Ethiopia (E21) customer actively toggles application-level blocking as a live policy lever: lifting the block on YouTube plus four other apps caused a documented traffic surge and device alerts at the BOL-IGW site.
TSG's QUIC-parsing layer decrypts QUIC ClientHello payloads and parses a user-agent-like parameter from the decrypted content, deployed at the Ethiopia (E21) DIR-IGW site. A missing bounds check on this field caused a watchdog-timeout crash, confirmed via a MESA_Platform/quic GitLab commit (git.mesalab.cn/MESA_Platform/quic).
TSG integrates a licensed third-party DPI engine (versioned separately from TSG/App Sketch DB releases) that repeatedly segfaulted across many E21 (Ethiopia) NPB nodes over Oct-Dec 2023 when processing specific packet-encapsulation stacks (Ethernet->MPLS->IPv4->UDP, VLAN->IPv4->UDP), requiring an App Sketch DB version bump to resolve.