An internal Geedge/MESA research report titled '关于Refraction Networking的调研报告' surveys all three generations of decoy-routing/refraction-networking circumvention systems (Curveball, Telex, Cirripede, TapDance, Rebound, Slitheen, Conjure, Waterfall, MultiFlow, SiegeBreaker, Gossip, Slitheen++), summarizing each system's tagging mechanism, deployment status, and citing published academic traffic-analysis attacks against each -- including explicit note that TapDance is used inside Psiphon, V2Ray, and Trojan -- indicating this adversary actively tracks decoy-routing research as a candidate detection target rather than treating it as a solved/ignored threat.
折射网络的第一代系统包括：Curveball，Telex和Cirripede... Telex是2011年提出的概念，最新的更新版本是在2018年，目前已经在ISP上部署 ... Psiphon、V2Ray和Trojan等VPN也部署了TapDance
Defense implications
- Do not assume decoy-routing/refraction-networking designs are unfamiliar to this adversary -- this report shows a current, citation-complete internal literature review of the field, including known traffic-analysis weaknesses per protocol variant (tagging-field detectability, timing side channels, asymmetric-routing tells).
- If evaluating a Conjure/TapDance-style transport for Lantern, assume the specific weaknesses catalogued in the cited academic literature (timing attacks on Telex, non-resistance to flow analysis in first-gen/TapDance per Wustrow 2014) are already known to Geedge/MESA analysts, not just to the research community.
Related findings
A June 2024 internal MESA Team survey ('针对审查系统的科学研究及探测技术调研报告') catalogs the academic censorship-measurement toolkit (OONI, Augur, Satellite, Quack/Hyperquack, GFWatch, GFWeb, middlebox weaponization studies, traceroute-based middlebox localization, device fingerprinting) and separately reviews circumvention-tool countermeasures, explicitly naming Lantern alongside Psiphon, Tor Meek and Signal as tools using uTLS-style TLS ClientHello mimicry and domain-fronting.
An internal TSG operations/troubleshooting manual lays out TSG's full traffic pipeline (NIC -> mrzcpd/marsio capture driver -> sapp DPI engine -> firewall/proxy(KNI->TFE)/active-defense/WAN-NAT policy branches) and shows engineers using maat_redis_tool to pull the live Redis-synced blocking policy tables (TSG_SECURITY_COMPILE, TSG_OBJ_IP_ADDR, TSG_OBJ_APP_ID) and filter them by numeric policy/object ID to debug why a block rule isn't firing.
The internal 'MAAT网络流处理配置统一描述框架' engineering manual (v3.1.20, author 郑超, 2021) documents MAAT's Redis-synced rule-compilation framework and its RuleScan/Hyperscan-based pattern-matching engine (libmaatframe.so / librulescan), and records that RuleScan's fast-scan feature caused a production outage on 2019-03-19 and has been disabled ever since.
An internal TSG functional-requirements spec ('加密协议JG') defines device support for identifying and blocking ECH, ESNI and QUIC traffic via per-connection SNI/region-matching tables (e.g. DF_QUIC_REGION), plus a companion 'FD报文全流程感知' feature that both passively monitors and actively injects synthetic verification traffic end-to-end through the network path to compute a live per-rule 'CT率' (breakthrough/penetration rate) — the system self-measures how often its own QUIC/ESNI/ECH blocks fail to take effect, and separately throttles logging/blocking detail for rule IDs receiving unusually high hit counts (DF_ATTACK_PROTECTION, 'targeted attack detection').
An internal MESA Lab report (2021-06-25) documents a live test in which a second sapp instance ('sapp B') receives fully decrypted plaintext HTTP traffic via a Unix domain socket from a third-party TLS decryption platform, while sapp A separately captures raw ciphertext via the mrzcpd driver. 24 hours of the decrypted logs (319,569 HTTP records) show the top intercepted destinations are Facebook, Twitter, Google/YouTube and Instagram, with client IPs traced to residential China Telecom/Unicom/Mobile subscribers in Guangdong, Zhejiang and other provinces.
Raw structured DNS event logs (dated 2021-08-23) captured from what appears to be a GFW-adjacent DNS monitoring/injection pipeline use a schema purpose-built for DNS response forgery ('CHEAT_TYPE', 'CHEAT_RCODE', 'CHEAT_STRATEGY', 'CHEAT_RR', 'INJECTED_PKT_FILE' fields) alongside per-query geolocation; sampled records show lookups for facebook.com and tiktokv.com originating from residential China Telecom/Unicom/Mobile subscriber IPs in Guangdong, Zhejiang, Anhui and other provinces, resolving against both domestic and foreign (8.8.8.8, OpenDNS) resolvers.