Abstract:
The Great Firewall of Iran (GFI) has evolved significantly over the past decade, constantly adding sophisticated blocking techniques. Prior research into Iran’s Internet censorship, however, has primarily been one-off studies, leaving significant gaps in understanding the breadth and evolution of its filtering strategies. Exploiting the bidirectional blocking behaviors of the GFI and its own injection mechanisms as a side-channel to determine traffic disruption, we developed IRBlock, a novel large-scale, multi-protocol measurement system designed to measure DNS, HTTP, and UDP-based censorship across Iran, enabling continuous monitoring and in-depth exploration of the GFI’s blocking behavior.