Reality + gRPC appears to be more resistant to censorship than Reality + Vision

[AmirHosseinCV]

I've experimented with various configurations for reality. Although vision is commonly used and recommended for reality, gRPC appears to be more resistant to censorship. For instance, I set up a server on Linode using vision, and my server was blocked after only four hours. However, when I used the same configuration with gRPC, it continued to function well after a week, handling more than 800GB of traffic daily.

I'm curious if there's a logical explanation for this. I even tried 'reality with steal yourself', using domains on the same IP ranges, and so on, but with vision, it seems to be an easy target for censorship systems.

[hawshemi]

Reality + gRPC is NOT resistant to GFW.
Iran's GFW just doesn't care about gRPC FOR NOW.

Yes, even the h2 protocol is connecting with fabulous stability and persistence but it's not Iran's GFW main focus right now. (as it was, just a month ago the h2, h3, grpc, quic protocols were all just blocked)

[us254]

"The experience of some people was the opposite. They claim that they were working with vision Reality for three months without any issues, but they encountered a blockage when they switched to using gRPC. In my own experience, I have consistently used vision Reality and have never encountered any blocking issues, even during those times when many others complained about vision Reality being blocked."

1. HTTP/2 (gRPC) is TCP-based.
2. HTTP/3 (QUIC) is UDP-based.

also important to note that the server's hosting provider (like Linode) and its network can play a significant part in this. Some hosting providers may have their network traffic closely scrutinized or their IP ranges targeted by censors due to past abuses.

[AmirHosseinCV]

Interesting! However, I'm curious as to why reality + vision is easily detected on some data centers like Linode. Does it have a fingerprint or something? It's working fine for me on some data centers with obvious SNIs like www.googletagmanager.com, but on others like Linode, it's easily detected even with the most accurate configurations (e.g., steal yourself, a domain on the same IP range, port 80 forwarding, disabling SSH, using separate IPs for inbound and outbound traffic, etc.).

[hawshemi]

I'm testing the GFW behavior for that especially MCI. now I'm at the third test and after 8 tb trrafic the server is ok.
Right now my conclusion is:

1. Reality by itself is not detectable.
2. It's all about (IP,SNI) tuple...
   The most important parameter for Iran gfw is SNI traffic. It should be logical based on the VPS IP address and the region. I will write a comprehensive report on /net4people/bbs .

[AmirHosseinCV]

I'm not entirely convinced. While the significance of SNI is undeniable, if it were the root cause, then using the same SNI on the same IP range with gRPC should also fail, but it doesn't. I've tested Vision and gRPC multiple times on the same IP range and SNI. Each time, Vision gets detected, but gRPC operates without any issues.

[us254]

whether your REALITY is hosting Vision or H2/gRPC, but currently their traffic characteristics are not consistent with pure HTTPS. I guess the speed limit may be related to this." " Judging from the experience at the end of last year and even in recent years, in many cases, GFW’s blocking strategy prioritizes the one that has the most use and the greatest benefits, rather than whether your protocol features are obvious or not."