Eleven separate TSG session-log exports (all device_group XXG-TSG-BJ) each isolate one named commercial VPN app under a dated, patch-versioned signature and record security_action=Deny for every matched session: BeePass VPN, VPNHero, JumpJumpVPN, BigMamaVPN, AlohaBrowserLite, VPNMonster, QuarkVPN, SecureVPN, and BetternetVPN. This is live enforcement evidence (not passive mirroring) for at least nine distinct commercial VPN products, each individually fingerprinted and actively blocked.
Deny_BeePassvpn,Deny,,【Don't disable】Service Chain_Mirror,0906 statistics,[2002]
Defense implications
- The operator maintains and actively enforces individual, dated signatures per VPN brand rather than one generic 'VPN traffic' rule — a circumvention tool with a distinctive, stable per-release fingerprint is a tractable target for this pipeline even without deep protocol changes.
Related findings
Side-by-side internal performance comparison across Xinjiang (China Mobile carrier deployment, hostname cmcc-xj-server1-sapp-244), Fujian (domestic), and Ethiopia (E21) explicitly references the same 'app_sketch_maat' diagnostic log format at all three sites, confirming the identical AppSketch app-fingerprinting stack is used for domestic Xinjiang surveillance and for the exported Ethiopia deployment.
TSG's app/protocol detection ("AppSketch" / context_based_detector plugin, part of the SAPP packet pipeline) is not purely static-signature: each detection rule can be an arbitrary Lua script (APP_SIG_LUA_SCRIPTS table) executed per-session in a per-worker-thread LuaJIT VM, with access to packet payload, session context counters, and helper functions (APP.data, APP.context.c2s_count, APP.log_debug, APP.append_extra_info). A validation CLI tool (luac-tool) checks script syntax, timeout, and return-value type before import.
Root-caused an Ethiopia SNI-block-failure incident to the detection mechanism itself: APP_SKETCH's FQDN-scanning module -- which exists specifically to identify Psiphon3 and Freegate via top-N SNI matching -- was CPU-expensive enough to saturate cores, triggering sapp's fail-open DDoS bypass and letting some target connections through uninspected. A signature-structure fix roughly doubled throughput (33K/s to 73K/s new connections) and disabling the fail-open bypass restored reliable blocking.
Reveals internal architecture of TSG's traffic classification engine: the 'sapp' process (binary at /opt/tsg/sapp/sapp, version sapp-4.2.90) uses a packet-I/O layer called 'marsio', a custom app-identification plugin 'app_sketch_local' (identify_app_by_tcp_payload / identify_app_by_user_define_attributes), and an embedded LuaJIT ('libelua') for user-defined protocol signatures (e.g. custom Modbus detection) — concurrent LUA script loading crashes the classification worker.
TSG's DPI signature engine is organized around named internal components confirmed by config paths and error logs: SAPP (installed at /home/mesasoft/sapp_run or /opt/tsg/sapp), MAAT (config at .../tsgconf/maat.conf, tied to a Redis-backed APP_SIG_SESSION_ATTRIBUTE_STRING table), and App-SketchDB (a versioned, centrally-maintained app-identification signature database pulled periodically by field deployments). One deployment's provincial gateway alone had 1,667 TCP/UDP first-packet payload signature entries active (396 at the IDC site), confirming payload-prefix matching as a live, large-scale detection method, including custom byte-prefix entries for DingTalk and WeChat.
Live TSG mirror-mode session logs (device_group XXG-TSG-BJ) show a granular, weekly-cadence app-classification chain for Turbo VPN — signatures dated TurboVPN_Patch01 through Patch08 (Sept 2024-Oct 2024) — with "Psiphon-Server"/"Psiphon Provider" recognized as an intermediate hop the classifier walks through before landing on "Turbo VPN", plus separate live detections of Proton VPN and "Super Unlimited VPN" (SuperUnlimitedVPN) in a second export from the same device group.