Hacker News Reader

Comment by tptacek | Hacker News Reader

So... this is basically fragrouter? [1]

If so, this is a very old idea (I, uh, co-invented it?). A lot of DPI gear isn't built for serious security, but rather best effort, and I'm sure basic TCP tricks like this will bypass those. But you should be aware that serious, modern middleboxes were very definitely built with knowledge of fragrouter-type tricks (and of evasion more generally), and you're better off using a VPN than relying on stuff like this if your evasion actually matters from an opsec perspective.

[1]: https://www.monkey.org/~dugsong/fragroute/

View on HN

> So... this is basically fragrouter?

No, not really. GoodbyeDPI does not perform IP-level fragmentation, it does not generate/send any packets at all, it only modifies them or drop them.

What's called "Fragmentation" in GoodbyeDPI is TCP Window Size shrinking, to force OS to send TCP packets of small size.

I'm aware of fragroute, and I have plans to implement some of its techniques in GoodbyeDPI.

Fragrouter, and the paper it's based off of, does a bunch of TCP manipulation; "frag" is just a shorthand.

I think DPIs might also be used to detect VPNs. I'm not familiar with VPN traffic patterns situation but I doubt that it's too chaotic or masquerades as something else, since VPNs weren't invented with DPI in mind.

Not to imply that GoodbyeDPI assuages all my doubts, either.

DPI can certainly be used to detect VPNs, but my broader point is, if you want real assurance, you need to get a VPN working; you can't rely on TCP/IP reassembly glitches, because they're largely addressable by the serious DPI vendors.

I think it's right to say you can't rely on those older methods, but there has been a lot of research that's gone into DPI bypass. The HTTP Evader work that's been done is particularly good [0]. In some cases the guarantee of operating a VPN over a hostile network isn't guaranteed, especially something like IPsec. So it's good that the simplistic fragmentation methods of tools like fragrouter have been expanded on.

[0] https://noxxi.de/research/http-evader.html

The stuff HTTP Evader is doing is simpler still than the stuff fragrouter (and this tool) does. Middlebox evasion is a cat and mouse game. I'm fine with people playing that game, but not with their lives; if real opsec is on the line, you need a VPN.

Sorry, n00b here, but a friend was telling me about a new version of Internet Protocol that fixes man in the middle attacks, like deep packet inspection. Is that realistically coming anytime soon?

It is an impossibility. Protocols are layered and so at one layer you can add features to detect possible MITM (eg. IPSec, SSL etc.) but cannot always be eliminated.

I suggest you consult a book like "The TCP/IP Guide" to get an overview of the main data protocols and how they work. In this day and age, everybody ought to know something about the basic protocols which form the bedrock of our networked society.

Detecting VPNs is not an issue in most places since VPNs are allowed.

Reply on news.ycombinator.com