When using the default --segment-order 0,1, some sites return PR_END_OF_FILE_ERROR (connection closed by server) even though DPI is successfully bypassed.
Root cause (hypothesis)
TLS record header is exactly 5 bytes (0x16 0x03 0x01 [length 2B]). Splitting at byte 1 delivers an incomplete record header to the server, which may cause some TLS stacks to close the connection instead of waiting for the rest.
Splitting at 0,5 (dpibreak -o 0,5) resolves the issue, but risks DPI reassembly defeating the bypass. (In my case, 0,5 bypasses the DPI also)
When using the default
--segment-order 0,1, some sites returnPR_END_OF_FILE_ERROR(connection closed by server) even though DPI is successfully bypassed.Root cause (hypothesis)
TLS record header is exactly 5 bytes (
0x16 0x03 0x01 [length 2B]). Splitting at byte 1 delivers an incomplete record header to the server, which may cause some TLS stacks to close the connection instead of waiting for the rest.Splitting at
0,5(dpibreak -o 0,5) resolves the issue, but risks DPI reassembly defeating the bypass. (In my case, 0,5 bypasses the DPI also)