Under peak traffic (~700K logs/sec vs. normal ~450K/sec), Ethiopia's TSG deployment's log-aggregation pipeline (Kafka/Flink) dropped roughly 30% of session logs due to load imbalance across nodes, meaning session visibility during traffic peaks is measurably incomplete, independent of the detection engine's accuracy.
在流量高峰期（日志量>45w/s时,当前峰值日志量70w/s），分中心Flink汇聚日志出现负载不均情况 [at peak traffic (log volume >450K/s, current peak 700K/s), the regional-center Flink log aggregation showed load imbalance across nodes]
Defense implications
- Traffic generated during known peak-usage windows may be systematically under-logged for retrospective analysis/enforcement, even if real-time blocking still applies — a distinct weakness from the traffic-completeness gap.
Related findings
Ethiopia (E21) customer specifically tested Melon VPN and Ultrasurf against TSG; Ultrasurf's frequently-rotating IPs required an updated signature (successfully blocked after update), while Melon VPN's connection succeeded but was non-functional for other reasons (not attributed to TSG blocking).
Confirms the full licensed TSG component roster deployed at Ethiopia (E21): Firewall, Digital Observer, Email Retention, Statistics Policy, Proxy, Session Record, GTP Security, AppSketch, AppSketch Engine, AppSketch DB, WebSketch, WebSketch DB. Several license terms were extended to expire 2091-12-31, indicating a multi-decade commercial commitment.
A field-operations runbook, "子卡槽位更换操作流程" (card-slot swap procedure), documents live maintenance work at the "Shashamane-IGW" site — one of the Ethiopian international-gateway sites named in the E21 site-codename mapping — upgrading an 8x10G link to 1x100G on device "9000-SMBIO-P01R01-1", including commands to force optical channels to bypass mode, physically relocate an optical port card, and switch the link back from bypass to inline mode, confirming the deployment operates in a passive/bypass-capable inline architecture.
Side-by-side internal performance comparison across Xinjiang (China Mobile carrier deployment, hostname cmcc-xj-server1-sapp-244), Fujian (domestic), and Ethiopia (E21) explicitly references the same 'app_sketch_maat' diagnostic log format at all three sites, confirming the identical AppSketch app-fingerprinting stack is used for domestic Xinjiang surveillance and for the exported Ethiopia deployment.
Direct dated evidence (July 2023) that the Ethiopia (E21) customer actively toggles application-level blocking as a live policy lever: lifting the block on YouTube plus four other apps caused a documented traffic surge and device alerts at the BOL-IGW site.
The 'E21' site code in Geedge's internal Jira maps to an Ethiopia deployment sold/serviced through CEIEC (中国电子进出口, a Chinese state-owned defense electronics company) as an intermediary — Geedge explicitly white-labels delivery documentation with an OEM template before it reaches CEIEC, and CEIEC's Ethiopia office director is named as directly relaying the customer's blocking requirements.