Currently, fragment.rs uses randomized chunk lengths (size_min..size_max, default 16–32 bytes) applied across the write buffer:
let chunk_len = this.cfg.pick_chunk_len(buf.len());
While this works well against stateless DPI filters, modern stateful DPI middleboxes (such as recent equipment deployed by TIC in Iran) have increased their TCP stream reassembly buffers to hold packets across 20–50ms windows. If chunks are sliced blindly, the DPI buffer occasionally reassembles the TLS ClientHello successfully before timeout.
Proposed Solution
In addition to (or as an alternative to) blind chunking, consider supporting Targeted Split-SNI:
- Locate the Server Name Indication (SNI) extension inside the TLS ClientHello record.
- Specifically split the TCP stream precisely inside the SNI domain string (e.g., sending the first TCP segment ending right in the middle of
cloudflareclient, and the remainder in the next segment).
Targeted SNI splitting has proven extremely resilient against stateful TCP stream reassembly in tools like Zapret, GoodbyeDPI, and Sing-box, as it corrupts in-line regex/signature matching without relying solely on large inter-packet delays.
Currently,
fragment.rsuses randomized chunk lengths (size_min..size_max, default 16–32 bytes) applied across the write buffer:While this works well against stateless DPI filters, modern stateful DPI middleboxes (such as recent equipment deployed by TIC in Iran) have increased their TCP stream reassembly buffers to hold packets across 20–50ms windows. If chunks are sliced blindly, the DPI buffer occasionally reassembles the TLS ClientHello successfully before timeout.
Proposed Solution
In addition to (or as an alternative to) blind chunking, consider supporting Targeted Split-SNI:
cloudflareclient, and the remainder in the next segment).Targeted SNI splitting has proven extremely resilient against stateful TCP stream reassembly in tools like Zapret, GoodbyeDPI, and Sing-box, as it corrupts in-line regex/signature matching without relying solely on large inter-packet delays.