• 0 Posts
  • 33 Comments
Joined 11 months ago
cake
Cake day: August 8th, 2023

help-circle













  • Latency plays a big role in throughput. If one download target was ‘closer’, i.e. lower latency, it will be able to scale the windowsize higher, therefore allowing more data to flow through for a given connection. Imagine network packets are envelopes and data is paper. Not all envelopes can carry the same amount of paper for a given connection, and the more paper you stuff in your envelope, the faster the transfer completes.







  • You are absolutely correct, I should have lead with that. Encrypted client handshake means no one can see what certificate you are trying to request from the remote end of your connection, even your ISP.

    However, It’s worth noting though that if I am your ISP and I see you connecting to say public IP 8.8.8.8 over https (443) I don’t need to see the SNI flag to know you’re accessing something at Google.

    First, I have a list of IP addresses of known blocked sites, I will just drop any traffic destined to that address, no other magic needed.

    Second, if you target an IP that isn’t blocked outright, and I can’t see your SNI flag, I can still try to reverse lookup the IP myself and perform a block on your connection if the returned record matches a restricted pattern, say google.com.

    VPN gets around all of these problems, provided you egress somewhere less restrictive.

    Hope that helps clarify.