Inside the Great Firewall Part 2: Technical Infrastructure

The piece explains that the Great Firewall Part 2 delves into the technical infrastructure behind China’s censorship ecosystem, drawing on more than 7,000 files from a 500GB data dump. At its core is the Traffic Secure Gateway (TSG), a modular DPI platform deployed across national backbones and regional access points, with central hubs like the YGN Center and tools such as Cyber Narrator enabling real-time session inspection and rule propagation.

The report highlights layered filtering using SNI-based TLS detection, JA3 fingerprinting, and behavioural profiling fed through MAAT, Gohangout, and Redis telemetry to push immediate session resets or flags, including attempts by tools like Psiphon, Shadowsocks, and V2Ray. It notes a centralised yet distributed architecture supported by multiple vendors and state entities, with explicit references to the NCSC and figures such as Fang Binxing, whom the article describes as linked to the GFW (claims).

Further, it describes a decentralized command queue and update propagation model, remote configuration push capabilities, and a predictive enforcement approach that assigns risk scores to sessions in near real time. The piece also discusses data fusion with identity markers and the potential use of the surveillance network in broader governance frameworks.