What it detects
- Detects the presence of a DPI device that sends TCP RST packets when it detects an offending connection
- A list of IP:port pairs to be tested.
- A TCP Connect scan is made to the remote IP:PORT
- If for the TCP connect we get back a RST packet then there is a DPI device injecting RST packets.
- What IP:ports are being blocked using this technique.
This is the kind of censorship that is happening in china as illustrated in this paper: http://www.cl.cam.ac.uk/~rnc1/ignoring.pdf