Taxonomy
Controlled vocabulary. IDs are shared with corpus.lantern.io where the concept overlaps; products, capability_categories, and site_codenames are new to this corpus.
Site codenames
| E21 | Ethiopia — carrier Safaricom Ethiopia plus Ethio Telecom; IGW sites Bole, Shashamane, Bahir Dar, Dire Dawa, Legehar, Kaliti, STEP HQ, Old Airport, Microwave, Nefas Silk, Kirkos. Customer identity: INSA (Information Network Security Agency), white-labeled as 'HDM'. Exported via intermediary CEIEC (China National Electronics Import & Export Corp). |
| K18 | Kazakhstan — sites include Astana (renamed from Nur-Sultan in 2022), Almaty (backup), Karaganda, Zhezkazgan, Aktau |
| M22 | Myanmar — carriers Mytel, Ooredoo Myanmar, ATOM; sites YGN (Yangon), MDY (Mandalay), plus border towns Tachileik/Kengtung/Myawaddy/Muse |
| WMS-UTR / P19 | Pakistan — sites include Karachi, Islamabad; ADC hardware. Same CEIEC/进出口 export-channel pattern as K18. |
Products
| appsketch | AppSketch / AppSketch Works / App Sketch DB App-identification signature system: "AppSketch Works" (中文: 特征工厂, "Feature Factory") is the internal product for extracting/verifying/distributing app and VPN blocking signatures; "App Sketch DB" is the versioned, centrally-maintained signature database it produces, pulled by field deployments on its own release cadence separate from TSG-OS/sapp version bumps. Hosted at subdomains of appsketch.geedge.net. Extends the open-source nDPI project's detectors in places (e.g. openvpn.c) rather than building every detector from scratch. |
| certstore | certstore TLS-interception (MITM) certificate service: per-connection Trusted/Untrusted profiles, certificate-pinning-detection classification, Dynamic Bypass toggle. |
| cybernarrator | CyberNarrator / vpn-thwarting (网络叙事者) Two related but distinct components, both internally called "CN": (1) an automated Psiphon3 IP-harvesting/learning pipeline ("vpn-thwarting") that pushes freshly-learned server IPs into a live blocklist object roughly hourly, observed at ~70-73K IPs; and (2) a subscriber-identity correlation engine deployed at a Pakistan site that ingests carrier RADIUS/AAA data (Jazz, Zong, Ufone, Telenor) to resolve each monitored session to a phone number (Calling Station ID) and writes that identity into security-policy objects roughly every 10s. Sales/training materials for this capability instruct concealing Geedge's branding and internal hostnames from the customer's own trainees — see capability category `subscriber-correlation`. |
| glimpse_detector | glimpse_detector Geedge-built component specifically for VPN protocol identification (WireGuard, OpenVPN), distinct from the licensed third-party general DPI engine TSG also runs. |
| maat | MAAT / maatframe Hyperscan-based (with a "Rulescan" fallback above ~50K rules) pattern-matching rule engine underlying sapp's signature matching (libmaatframe.so, librulescan.so). Observed at 500K+ FQDN rules and 400K+ IP rules in a single production instance. Config synced via maat_redis_tool from a Redis-backed live table (APP_SIG_SESSION_ATTRIBUTE_STRING). |
| marsio | Marsio (marsio4/marsio5) DPDK-style, hugepage-backed packet-I/O framework sapp runs on top of. Handles encapsulation (VXLAN/GTP) metadata extraction and, for unencapsulated mirrored traffic via the "wired_graft" plugin, injects link/circuit identifiers into copied packets' MAC field for downstream session-log correlation. |
| mrzcpd | mrzcpd Packet-mirror/capture and inline packet-injection agent (config /opt/tsg/mrzcpd/etc/mrglobal.conf). Sits between raw traffic capture and sapp's inspection stage; for mirror/passive-tap deployments, sapp's generated blocking (RST) packets are re-injected into the link via mrzcpd rather than sent from a management NIC. |
| sapp | SAPP platform MESA Lab stream-processing platform (GitLab: MESA_Platform/sapp, binary /opt/tsg/sapp/sapp); per MESA's internal timeline, "began large-scale engineering deployment" in 2014. This is TSG's core traffic-inspection engine, not a separate product — TSG-OS ships sapp as its DPI/classification component. Runs as Kubernetes pods (deploy/tsg-traffic-engine-vsys-*) built from the MESA_Platform monorepo, directly tying the MESA Lab codebase to the commercial TSG product at the build-path level. |
| tsg | Tiangou Secure Gateway (TSG) Geedge Networks' flagship DPI/censorship+surveillance gateway product. The exported system. Hardware branded TSG-X, OS layer TSG-OS. |
| tsg_master | tsg_master Core traffic-processing daemon distinct from sapp (GitLab: tango/tsg_master, packaged via tsg-os-buildimage). Confirmed via crash/fix commits. |
Capability categories
| active-probing-impl | Active-probing implementation detail |
| content-injection | Live content injection / rewriting Distinct from mitm-cert-implant: that category is the interception mechanism (the fake root CA), this one is what's done with it once traffic is decrypted — confirmed live capabilities include HTTP response replace/insert/hijack actions and direct JavaScript injection into intercepted responses, demonstrated in testing against Google/YouTube's own API traffic and other major platforms. A finding usually needs both tags together. |
| deployment-config | Deployment / customer configuration Evidence of where and how the system is deployed for a specific customer. |
| dpi-signature | DPI detection signature / rule A specific protocol-detection rule, regex, or classifier feature extracted from source or config. |
| export-sales | Export / sales / contract evidence Commercial evidence (contracts, schedules, correspondence) of a customer relationship — not a technical capability per se, but load-bearing for the 'who' half of the story. |
| keyword-filter-list | Keyword / content filter list |
| mitm-cert-implant | TLS interception / certificate implant |
| org-personnel | Organizational / personnel information HR-adjacent or individually-identifying content (names, org charts, internal chat). Default posture: extract nothing here beyond what's needed to corroborate a technical or export-sales finding. Never a target category on its own — see README PII policy. |
| subscriber-correlation | Subscriber/individual identity correlation Ties a network session to a specific person (IMSI, phone number, RADIUS Calling Station ID, eNB cell-tower geolocation) rather than just an IP or protocol fingerprint. Materially different threat model from blocking/detection — this is the lawful-intercept / mass-surveillance side of the product, confirmed operating alongside (not instead of) blocking. |
Censors
| bri-unidentified | Unidentified Belt-and-Road customer |
| cn | China (Great Firewall) |
| et | Ethiopia |
| generic | Generic / not censor-specific |
| kz | Kazakhstan |
| mm | Myanmar |
| pk | Pakistan |
Techniques
| active-probing | Active probing |
| asn-blackholing | ASN / prefix blackholing |
| bgp-hijack | BGP / route manipulation |
| dns-poisoning | DNS injection / poisoning |
| dpi | Deep Packet Inspection |
| esni-eh-blocking | Encrypted ClientHello / ESNI blocking |
| flow-correlation | Flow-correlation traffic analysis |
| fully-encrypted-detect | Fully-encrypted protocol detection |
| http3-quic-block | QUIC / HTTP/3 blocking |
| ip-blocking | IP-list blocking |
| keyword-filtering | Keyword filtering |
| middlebox-interference | Middlebox / TCP normalization |
| ml-classifier | ML / statistical classifier |
| packet-injection | Packet injection (general) |
| port-blocking | Port-based blocking |
| random-payload-detect | Random / high-entropy payload detection |
| rst-injection | TCP RST injection |
| sni-blocking | SNI-based blocking |
| throttling | Throttling / bandwidth shaping |
| tls-fingerprint | TLS ClientHello fingerprinting |
| traffic-shape | Traffic-shape / statistical fingerprinting |
| website-fingerprint | Website fingerprinting |
Defenses
| amnezia-wg | AmneziaWG (obfuscated WireGuard) |
| anytls | AnyTLS |
| bridges | Bridges / private relays |
| domain-fronting | Domain fronting |
| ech-esni | Encrypted ClientHello / ESNI |
| hysteria2 | Hysteria 2 (QUIC-based) |
| mimicry | Protocol mimicry |
| pluggable-transport | Pluggable transport (Tor PT framework) |
| randomization | Traffic randomization / shaping |
| reality | REALITY (TLS handshake forwarding) |
| reverse-tls | Server-initiated TLS |
| shadowsocks | Shadowsocks family |
| steganography | Steganography |
| tor | Tor (onion routing) |
| trojan | Trojan (TLS-mimicking) |
| tunneling | Tunneling inside an allowed protocol |
| vless | VLESS (V2Ray) |
| vmess | VMess (V2Ray) |
| water-wasm | WATER (WASM-based pluggable transports) |
| webrtc-pluggable | WebRTC-based pluggable transport |