tsg_master computes and logs JA3 TLS ClientHello fingerprints (feature present since at least 2020, field renamed common_ja3_fingerprint -> common_ja3_hash; toggle GENERATE_JA3_FINGERPRINT added 2023) and, since 2023, also outputs OS-fingerprint log fields (common_client_os_name, common_server_os_name), plus improved SSL/TLS detection when the ClientHello is split across multiple TCP segments.
commit abcc94dc (2020-09-11) subject: "支持JA3指纹" (support JA3 fingerprint); commit 4389d188 (2023-07-24) subject: "支持不依赖ssl解析层生成ja3_fingerprint，增加是否生成ja3_fingerprint的开关, GENERATE_JA3_FINGERPRINT=1"; commit f7ab3c92 (2023-10-13) subject: "TSG-17290: 支持输出OS fingerprint日志字段"; commit 6f433c9b (2023-09-07) subject: "client hello分数据包传输时，增强支持识别SSL协议的条件" (enhanced SSL recognition when ClientHello is fragmented across packets)
Defense implications
- Splitting/fragmenting the TLS ClientHello across multiple TCP segments is an evasion TSG has specifically hardened against since 2023 — do not rely on ClientHello fragmentation alone to evade GFW-derived DPI.
- JA3-based fingerprinting has been in production since 2020; any TLS-mimicking transport should randomize/vary its ClientHello extension order and cipher list to avoid a stable JA3 hash.
Related findings
A live tsg_master engine config file exposes a [RESET] section with concrete TCP-RST-injection parameters (NUM=1, SEED1=65535, SEED2=13, FLAGS=20, DIR=3, REMEDY=0), a [TRAFFIC_MIRROR] section confirming mirror-tap deployment (NIC_NAME="eth_vf_mirr"), a [MAAT] section wiring tsg_master directly to MAAT's subscriber-ID tables (TSG_OBJ_SUBSCRIBER_ID/TSG_DYN_SUBSCRIBER_IP), and a device tag "BeiJing-XXG" confirming this specific instance is a domestic Beijing deployment. A plaintext Kafka SASL credential (SASL_PASSWD="galaxy2019") is also exposed, and "galaxy" recurs as an internal project codename elsewhere in this batch (docker service path /home/galaxy, APP_BRIDGE_NAME).
TSG's DNS enforcement plugin (tango/fw_dns_plug, packaged with tsg_master) implements DNS response spoofing as its DENY action, sending forged/deceptive DNS answers, with differentiated behavior for mirror (passive-tap) vs inline deployments: mirror mode only spoofs a response to the request, while inline mode drops the real answer and injects a forged one.
An official "Geedge Networks Confidential And Proprietary" sapp/mrzcpd operations manual documents the packet-injection API (MESA_kill_tcp / MESA_inject_pkt) used for both out-of-band mirror-tap RST injection (relies on the local box's own IP routing table to send) and inline in-path injection (requires mrtunnat.conf tunnel-tracking state -- use_recent_tunnel, use_link_info_table -- keyed on outer/inner MAC and link_id/link_dir), plus the Marsio DPDK-based driver's I/O sub-modes (marsio4, marsio_vxlan, pag_marsio, agent_smith) and its role extracting VXLAN/GTP encapsulation metadata and stamping link/circuit identifiers into mirrored packets' MAC field for session-log correlation.
A crash backtrace from an Ethiopia-site TSG-OS node reveals internal DPI plugin architecture: a core 'sapp' binary (/opt/tsg/sapp/sapp) loads protocol-dissector plugins (dtls, tsg_master.so) chained through a 'marsio4' packet-processing worker, with a KNI/DPDK-style packet path (eth_entry -> ipv4_entry -> vxlan_entry -> gtp_entry -> dtls dissector). The specific bug was an uninitialized DTLS hello-verify cookie field.
TSG's core traffic-processing daemon is named tsg_master (GitLab repo git.mesalab.cn/tango/tsg_master, part of the "TSG Appliance" project group). A 2023-07 field incident (site "P19") showed a single-core deadlock in tsg_master's log-sending path (function tsg_send_log) causing 100% CPU on one thread and packet loss; fixed in tsg_master-6.0.38 and shipped via the tsg-os-buildimage repo.
The tsg_master core DPI/blocking daemon's GitLab repository carries a dedicated long-lived branch "dev-K18" alongside version-numbered TSG-OS release branches, confirming Kazakhstan (K18) receives its own customer-specific development branch of the product's core traffic engine, not just configuration-level customization.