Internal spec for "spacemap-service", a passive-DPI-fed reconnaissance database and web UI that catalogs every observed website's IP/domain, geolocation, ASN, DNS server, CDN vendor, TLS certificate fields (issuer/CN/SNI), OS and web-framework fingerprint (via Wappalyzer), and WHOIS/ICP registration data, exposing reverse-lookup search by any single attribute (e.g. all sites behind a given cert issuer, ASN, or CDN vendor).

A DPI session-plugin ("stellar" framework) SSL/TLS decoder fully parses live ClientHello/ServerHello handshakes, computing JA3/JA3S fingerprints (MD5 over version+cipher-suites+extensions with GREASE values stripped per the standard JA3 spec), extracting plaintext SNI, explicitly flagging whether a ClientHello carries ESNI (extension type 0xFFCE) or ECH (extension type 0xFE0D), and decoding full X.509 certificate chains (issuer/subject RDN sequences, SAN, validity window, serial, pubkey, signature algorithm) in real time. It also recognizes TLCP 1.0 (China's national "国密"/GmSSL TLS variant) as a distinct protocol version alongside SSLv2 through TLS1.3.

Exported AppSketch/MAAT signature-object JSON shows named per-VPN detection rules combining multiple independent vectors: CyberGhost's WireGuard variant is matched by a hex UDP-payload pattern (04000000*), destination port 1337, and ip.proto=17 together (signature cyberghostvpn_wireguard); Windscribe's OpenVPN control channel is matched by two offset-anchored hex byte patterns plus an exact 86-byte payload length (windscribevpn_openvpn_payload); and ExpressVPN is matched independently via a literal JA3 hash (ssl.analysis.ja3), FQDN strings (expressapisv2.com, www.expressvpn.works), and a large enumerated IP list (700+ individual ip.dst entries observed before the 200KB text-extraction cutoff).

An IIE CAS technical whitepaper for the "High-speed Network Traffic Processing and Analysis System" names the "MESA" team (处理架构组MESA团队, "Massive Effective Stream Analysis") as part of IIE's Second Research Office, lists deployment case studies at China's National Administration of State Secrets Protection (国家保密局), the National Computer Network and Information Security Management Center, Guangdong provincial e-government services, and CNCERT (国家互联网应急中心), and gives a named IIE contact (name/phone/email redacted here). The product classifies behavior inside encrypted tunnels (remote control, audio/video calls, encrypted mail, VPN) and dozens of IM/social apps via SSL/SSH/IPSEC/QUIC/SOCKS protocol detection.

An internal app-fingerprint engineering document (identical content filed under two separate artifact ids) catalogs precise per-action (login/create/upload/ download/share/delete) DNS, SNI, and certificate-CN signatures for identifying use of specific cloud-collaboration apps from traffic alone, covering foreign platforms Zoom and Office365 alongside domestic apps (Huawei WeLink, Feishu, DingTalk, WeCom, Shimo Docs, CSTCloud drive), using tools like myssl.com for active certificate/IP verification of each signature.

Crash-dump stack traces reveal TSG's core packet-processing engine (sapp) architecture: a custom multi-threaded C engine using 'marsio' as the DPDK-style packet-I/O driver, a plugin system for protocol handlers (confirmed: plug/protocol/http/http.so), and a libdocumentanalyze component that actively decompresses gzip content and parses ZIP/document formats found inside HTTP bodies -- i.e. inspection goes beyond headers into reconstructed application content.

TSG implements heuristic tunnel-protocol detection distinguishing Teredo (IPv6-over-UDP, default port 3544) from GTP tunneling based on UDP payload inspection, used to decide 'innermost' session attribution for firewall matching.