TSG's inline blocking capability (the kni role) is implemented as separate per-protocol plugins — fw_dns_plug, fw_ftp_plug, fw_http_plug, fw_mail_plug, fw_ssl_plug, fw_quic_plug, fw_voip_plug — while a distinct 'TFE' role handles forwarding of TLS traffic decrypted by certstore's MITM stage, per a 2019 commit adding 'TFE配置文件中关于解密流量转发的配置' (config for decrypted-traffic forwarding in the TFE config file); TFE's Ansible role explicitly requires mrzcpd (require-mrzcpd.conf.j2). TFE is not currently a named entry in the products taxonomy despite being a core, independently-versioned component (tfe-4.3.x rpm series) present in every TSG deployment in this repo.

An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.

The Xinjiang Mobile carrier traffic report (2023-05-15) states in its own QUIC-domain-ranking section that Xinjiang's intra-provincial traffic has begun carrying QUIC/HTTP3 (UDP-based) traffic that poses "a huge challenge" to the traditional parallel/out-of-band ("并联") traffic-access blocking method, and that effectively gatekeeping ("GK") UDP/QUIC traffic requires switching to an inline/in-path ("串联") blocking architecture — a direct internal admission that (as of mid-2023, in this province) the standard mirror-tap deployment could not reliably block QUIC.

The same 'tsg_galaxy_v3.session_record' schema carries explicit TLS-interception status fields per session -- proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, proxy_client_side_version, proxy_server_side_version -- confirming that certificate-pinning detection and MITM intercept/bypass outcomes (matching the 'certstore' product's Trusted/Untrusted/Dynamic-Bypass model) are logged at per-session analytics granularity across the whole platform, not just flagged transiently at the gateway.

TSG ships a built-in offensive "active defense" (主动防御) module named houyi (后羿), built on the sapp/marsio/mrzcpd stack, that performs spoofed-source-IP network-layer flood attacks, DNS/NTP/Memcached reflection-amplification attacks, and application-layer (HTTP/HTTPS) CC floods against a configured target. Spoofed source IPs are drawn from named CIDR-range "profiles" (e.g. 10.1.1.0/24), and policy is distributed via Redis and issued either through an interface called "安天" (Antiy) or by directly calling a "毕方" (Bifang) API. Deployment is via Ansible from git.mesalab.cn/tsg/houyi-deploy, packaged as RPMs installed under /opt/houyi and as sapp plugins under /home/mesasoft/sapp_run/plug.

Confirms a TSG-X/TSG-OS (v22.11) deployment at "新疆联通IDC" (Xinjiang Unicom IDC, a specific China Unicom data center), part of a domestic "XJ-NPM" project; core traffic-processing components are named "mrzcpd" and "sapp," both required to start successfully for the appliance to function.

For mirror/passive-tap deployments (Xinjiang trial-bureau and Fujian projects), TSG-OS could not send blocking (reset/deny) packets out via a management NIC in the then-current container-mode build — SAPP's generated blocking packets could only be re-injected inline via mrzcpd. This was filed as a required feature (accepted by a CTO-level engineer (name redacted) for the TSG23.07 release) confirming the deployment architecture is out-of-path traffic mirroring plus injected reset packets, i.e. classic side-channel RST-injection censorship, for at least these two sites.