A confidential ("内部资料 注意保密") 2020 MESA architecture-group report catalogs infrastructure recon (ICP registration, whois, DNS, FOFA scans, TLS-cert lookups) and packet-capture/SNI fingerprinting for seven video-conferencing services -- DingTalk, Zoom, Feishu/Lark, 科技云会, Teambition, Slack, and WebEx -- including specific SNI values observed for Zoom's China CDN deployment (e.g. cn01www3.zoom.com.cn, zoomawscn5281151165zc.zoom.com.cn).

An IIE CAS technical whitepaper for the "High-speed Network Traffic Processing and Analysis System" names the "MESA" team (处理架构组MESA团队, "Massive Effective Stream Analysis") as part of IIE's Second Research Office, lists deployment case studies at China's National Administration of State Secrets Protection (国家保密局), the National Computer Network and Information Security Management Center, Guangdong provincial e-government services, and CNCERT (国家互联网应急中心), and gives a named IIE contact (name/phone/email redacted here). The product classifies behavior inside encrypted tunnels (remote control, audio/video calls, encrypted mail, VPN) and dozens of IM/social apps via SSL/SSH/IPSEC/QUIC/SOCKS protocol detection.

A product brochure for IIE's "高速网络流量处理分析系统" (High-Speed Network Traffic Processing and Analysis System) -- built by the same MESA team (处理架构组) that develops sapp/TSG -- advertises identification of SSL/SSH/IPSEC/IKE/QUIC/SOCKS encrypted protocols, of behaviors inside encrypted tunnels including VPN use and encrypted email, and of dozens of IM/social apps by name (WeChat, QQ, WhatsApp, Instagram, Twitter, Messenger). It is deployed at China's National Administration of State Secrets Protection, the National Computer Network and Information Security Management Center, and Guangdong's provincial e-government data bureau, processing 20 Tbps across 50,000+ devices since 2002.

The Transformer_master.h header (part of the Maat/sapp DPI framework, dated 2023-05-04) defines a region-keyed DNS response-forgery subsystem (MSG_OPT_DNS_CHEAT_TYPE/RCODE/STRATEGY/RECORD/TTL, DNS_FAKE_INFO/DNS_FAKE_IP tables, TF_get_dns_response_strategy_id(user_region)) used specifically by the block ("FD") action path, plus a dedicated function to classify whether a detected L7 protocol is a VPN (TF_is_L7_vpn_prot), and native extraction of TLS JA3/JA3S client and server fingerprints.

NTC_SSL_COLLECT passively parses every TLS handshake in monitored traffic and streams the SNI, hex-encoded client and server cipher-suite lists (a JA3/JA3S-equivalent fingerprint), and full leaf-certificate fields (serial number, algorithm, issuer/subject CN, org, and country, validity window, and optionally the complete SAN list) to Kafka topic 'ntc_ssl_collect_log' for every TLS session, tagged with the same PROTO_ID/APP_ID/OS_ID/BS_ID/WEB_ID/BEHAV_ID classification label used across the T1 plugin family.

A confidentiality-marked ("内部资料 注意保密", 架构组/Architecture Group) MESA Lab research report systematically profiles 11 video-conferencing/collaboration platforms (DingTalk, Zoom, Feishu/Lark, WeCom, Tencent Meeting, WebEx, Huawei WeLink, Slack, Teambition, 科技云会, 小鱼易连) with SNI lists, TLS certificate fingerprints, DNS/whois infrastructure, and an explicit "passive traffic analysis feasibility" (被动流量分析可行性) verdict per app — direct precursor engineering work for per-app DPI detection signatures.

Internal fingerprinting research report builds SNI/TLS/certificate profiles and a repeatable packet-capture methodology (separately labeled login/logout/ping/remote-desktop/ssh activity captures, split by TCP vs. UDP) for Sunlogin (向日葵/Oray), TeamViewer, and OpenVPN — explicit precursor engineering work for building per-app/per-protocol DPI detection signatures, including for OpenVPN over both its TCP and UDP transport modes.