# Understanding Routing-Induced Censorship Changes Globally

Abhishek Bhaskar<EMAIL_ADDRESS>Georgia Institute of Technology and
Paul Pearce<EMAIL_ADDRESS>Georgia Institute of Technology

(2024)

###### Abstract.

Internet censorship is pervasive, with significant effort dedicated to
understanding what is censored, and where. Prior censorship measurements
however have identified significant inconsistencies in their results;
experiments show unexplained non-deterministic behaviors thought to be caused
by censor load, end-host geographic diversity, or incomplete
censorship—inconsistencies which impede reliable, repeatable and correct
understanding of global censorship. In this work we investigate the extent to
which Equal-cost Multi-path (ECMP) routing is the cause for these
inconsistencies, developing methods to measure and compensate for them.

We find that ECMP routing significantly changes observed censorship across
protocols, censor mechanisms, and in 17 countries. We identify that previously
observed non-determinism or regional variations are attributable to
measurements between fixed end-hosts taking different routes based on Flow-ID;
i.e., choice of intra-subnet source IP or ephemeral source port leads to
differences in observed censorship. To achieve this we develop new route-
stable censorship measurement methods that allow consistent measurement of
DNS, HTTP, and HTTPS censorship. We find ECMP routing yields censorship
changes across 42% of IPs and 51% of ASes, but that impact is not uniform. We
develop an application-level traceroute tool to construct network paths using
_specific_ censored packets, leading us to identify numerous causes of the
behavior, ranging from likely failed infrastructure, to routes to the same
end-host taking geographically diverse paths which experience differences in
censorship _en-route_. Finally, we explore our results in the context of prior
global measurement studies, exploring first the applicability of our findings
to prior observed variations, and then demonstrating how specific experiments
from two studies could be impacted by, and specific results are explainable
by, ECMP routing. Our work points to methods for improving future studies,
reducing inconsistencies and increasing repeatability.

Internet Censorship; Censorship Measurement; Routing

††journalyear: 2024††copyright: rightsretained††conference: Proceedings of the
2024 ACM SIGSAC Conference on Computer and Communications Security; October
14–18, 2024; Salt Lake City, UT, USA††booktitle: Proceedings of the 2024 ACM
SIGSAC Conference on Computer and Communications Security (CCS ’24), October
14–18, 2024, Salt Lake City, UT, USA††doi: 10.1145/3658644.3670336††isbn:
979-8-4007-0636-3/24/10††ccs: Security and privacy Network security

##  1\. Introduction

Internet censorship impacts the lives of 72% of people (House, 2016), with
governments and ISPs using sophistical in-network capabilities to manipulate
and disrupt DNS (Pearce et al., 2017b; Scott et al., 2016; Sundara Raman et
al., 2020), HTTP (Pearce et al., 2017a; Ensafi et al., 2014; Sundara Raman et
al., 2020), and HTTPS (Raman et al., 2020b; Sundara Raman et al., 2020; Niaki
et al., 2020a). The growing prevalence of Internet censorship has given rise
to significant measurement efforts focused on understanding the scale and
scope of censorship globally (Niaki et al., 2020a; Sundara Raman et al., 2020;
Pearce et al., 2017a, b).

The challenge of obtaining globally distributed hosts has made _outside-in_
measurement (Bhaskar and Pearce, 2022) an appealing alternative method of
understanding censorship. Outside-in measurement leverages the symmetric
nature of many countries’ censorship infrastructure to send measurements _to_
a vantage point in a censored area (instead of originating from) and then
observing any actions taken against that flow. Outside-in measurements have
demonstrated censorship globally, across DNS manipulation (Pearce et al.,
2017b), packet drops (Ensafi et al., 2014; Aryan et al., 2013), RST injection
(Pearce et al., 2017a; Ensafi et al., 2014; VanderSloot et al., 2018), and
block-page injection (Raman et al., 2020b).

At the same time, prior censorship studies found inconsistency in DNS, HTTP,
and HTTPS measurements, globally (Pearce et al., 2017b; Raman et al., 2020b;
Wang et al., 2017; Crandall et al., 2007; Weinberg et al., 2021; Anonymous,
2014; Wright, 2014; Xu et al., 2011; Nisar et al., 2018; Gill et al., 2015;
Winter and Lindskog, 2012; Ensafi et al., 2015). These appear in the form of
non-uniform censorship across a country/ISP (Pearce et al., 2017b; Wright,
2014; Xu et al., 2011; Nisar et al., 2018; Katira et al., 2023; Yadav et al.,
2018; Gill et al., 2015), variations in results over time (Raman et al.,
2020b), and RST injection not observed for certain experiments (Wang et al.,
2017). Inconsistency makes understanding censorship and reproducing results
challenging, impacting our ability to develop technical and policy
interventions.

Integral to the notion of outside-in censorship measurement is the idea that
measurements _to_ a specific vantage point will traverse at least some of same
set of the network infrastructure performing censorship as if _from_ a
vantage. Deeply embedded in that assumption is the concept of Equal-cost
Multi-path (ECMP) routing. Routers on the Internet use various fields of a
packet to construct a flow identifier (Flow-ID), and use that Flow-ID to
assign the packet to a flow for load balancing (Augustin et al., 2006). Flow-
ID is influenced by “ephemeral” fields such as source port, thus communication
between a single source IP and destination IP/port may take numerous possible
routes through the network (Vermeulen et al., 2020). While ECMP routing is
well understood (Vermeulen et al., 2020; Augustin et al., 2006), the extent to
which ECMP routing influences censorship measurement globally across protocols
is unknown.

Our work seeks to understand the extent of ECMP routing on outside-in
censorship measurement across protocols, mechanisms, and countries, with an
eye toward _why_ changes in route impact observed censorship. Prior work
exploring China’s Great Firewall’s (GFW) (Bhaskar and Pearce, 2022) DNS
injection identified that some source parameters resulted in variations in
injected DNS censorship. Their study is limited; they explore only China, and
only DNS censorship; both of which are known to exhibit unique behaviors among
the worlds’ censors (Hoang et al., 2021). Given such unique characteristics,
it is unclear if ECMP-induced censorship measurement variations are an
artifact of the GFW, or if such phenomena generalize across countries and
disparate censorship deployments and protocols. It also remains unclear _why_
such variations exist, and their impact on measurement studies.

We ask: Does ECMP routing influence outside-in censorship measurement
globally, is it a generalized phenomenon of censorship infrastructure, has it
impacted prior studies, and why? This problem is challenging as prior tools do
not allow control of the parameters that influence route, and prior traceroute
tools either produce stable-routes of packets that are not of interest (e.g.,
ICMP ECHO), or produce unstable routes of application level protocols (e.g.,
HTTP packets). To these ends we develop _Monocle_ , a new route-stable
censorship measurement and traceroute platform able to understand ECMP-induced
censorship changes not only across DNS, but also HTTP and HTTPS. _Monocle_
expands prior DNS tooling (Bhaskar and Pearce, 2022) while also developing new
methods to measure and traceroute RST packet injection, packet drops, and
censor blockpages, across protocols.

We conduct a global study of 21 countries, 3 network protocols, and 4
censorship mechanisms, aimed at quantifying the effect of ECMP routing on both
current remote censorship measurement as well as on prior studies. We find
that ECMP routing has significant impact on outside-in censorship measurement
across countries, affecting 17 of 21 countries, as well as all types of
protocols and mechanisms explored. Our results illustrate a complex
entanglement of end-to-end censor activity with low-level network behaviors
that were previously thought unrelated and not considered. We find 42% of IPs
and 51% of ASes show ECMP-induced changes in measured censorship, with that
impact unevenly spread across 17 countries. We also find that some source IP
and ephemeral source port combinations detect up to 2x more censorship than
others, between the same end-points.

We also utilize _Monocle_ to conduct censorship-and-path aware traceroutes of
_specific_ censored packets, enabling us to reconstruct network graphs, and
explain _why_ variations exist. We find a diverse set of explanations, ranging
from routing within ASes sending some packets to potentially failed
infrastructure, to routes to a single end-host spanning geographic regions
with diverse censorship _on-path_. We also explore the different forms of
observed variation in prior work, contextualizing when ECMP routing is
potentially applicable. Finally, we compare our results to 2 prior outside-in
studies, showing that previously observed non-determinism (Pearce et al.,
2017b) is explainable by source-parameter selection, and a reproduction of the
selection method of a prior censorship study (Raman et al., 2020b) using our
experiments shows as many as 35% end-points could experience ECMP-induced
variations.

Contributions.ContributionsContributions. Our contributions include:

  * •

Designing and deploying _Monocle_ , a platform able to quantify the effects of
ECMP routing on censorship measurement across DNS, HTTP, and HTTPS protocols,
and across DNS injection, RST injection, packet drops, and blockpage
censorship methods.

  * •

Finding that 17 of 21 countries explored with externally measurable censorship
show censorship differences by varying intra-subnet source IP and/or source
port, with the impact ranging from 100% to $<$1% of destinations showing
differences. We also find all types of protocols and censor methods impacted.

  * •

Finding that ECMP-induced differences are due to a diverse set of properties,
ranging from route differences within ASes performing censorship likely having
failed infrastructure on some paths, to routes to the same host having
geographic diversity, and that geography demonstrating non-uniform censorship.

  * •

Finding that previously observed non-determinism in a prior study (Pearce et
al., 2017b) is explainable by ECMP routing, and replication of the selection
method of a prior study (Raman et al., 2020b) that experienced non-determinism
shows up to 35% of its hosts could be impacted.

We thus argue ECMP routing must be taken into account when measuring in-
network phenomena, and that measurement knowledgeable of these properties can
remain a valuable research method.

##  2\. Related Work

Censorship measurement has evolved in the past decade to understand how
censorship works, what is censored, and how censorship changes over time. In
order to comprehensively measure censorship, studies built techniques to
perform measurements on various protocols: DNS (Farnan et al., 2016;
Anonymous, 2014; Lowe et al., 2007; Pearce et al., 2017b; Niaki et al., 2020b;
Scott et al., 2016), HTTP (VanderSloot et al., 2018; Weaver et al., 2009;
Ensafi et al., 2015; Nabi, 2013; Clayton et al., 2006), HTTPS (Bock et al.,
2021b; Chai et al., 2019; Bock, 2020; Raman et al., 2020b; Gatlan, 2019),
HTTP/3 (Elmenhorst et al., 2021), and echo (VanderSloot et al., 2018; Raman et
al., 2020b).

Most state-sponsored censorship is deployed at the ISP or network backbone
(Khattak et al., 2014; Zuckerman, 2010; Xu et al., 2011) in the form of
network middle-boxes that intercept packets and perform actions based on them;
such behavior affords measurement, whereby sensitive packets are sent across
the middle-box, and behaviors are studied. Measurement typically takes two
forms: 1) Outside-In (Remote) measurement, where packets are sent from outside
a country being measured towards points inside the country (Pearce et al.,
2017b; VanderSloot et al., 2018; Raman et al., 2020b; Sundara Raman et al.,
2020; Ramesh et al., 2020; Hoang et al., 2021; Pearce et al., 2017a; Bock et
al., 2021b; Niaki et al., 2020b, 2021; Aryan et al., 2013; Xu et al., 2011;
Farnan et al., 2016; Weinberg et al., 2021; Ensafi et al., 2015), or 2)
Inside-Out measurement, where measurements use observation points inside the
country from volunteers, VPN servers, etc, to send sensitive censorship
triggering packets (Niaki et al., 2020a; Hoang et al., 2019).

Both measurement types have trade-offs in deployability, ethical
considerations, and scalability. Several global censorship measurements employ
remote measurement techniques as it eliminates the need to have volunteers
inside all the countries being measured (Pearce et al., 2017b; VanderSloot et
al., 2018; Raman et al., 2020b; Sundara Raman et al., 2020; Ramesh et al.,
2020, 2023; Bhaskar and Pearce, 2022; Niaki et al., 2021; Nourin et al., 2023;
Raman et al., 2020a). While these systems are scalable and reduce the need for
volunteers, they in-turn can only measure censorship that is symmetric.
Measurements are generally conducted at the DNS, HTTP or HTTPS layer with
countries potentially performing censorship at any of these layers. At the
HTTP layer, studies generally use the Host:  header (VanderSloot et al., 2018;
Raman et al., 2020b; Ensafi et al., 2014) to include a sensitive payload, and
at the HTTPS layer a sensitive payload is encoded in the SNI: field (Chai et
al., 2019; Bock, 2020) of the HTTPS client-hello, that triggers various forms
of censorship like RST-injection, blockpages, packet drops etc. At the DNS
layer the sensitive payload (in the form of a domain) is issued as a DNS A?
query, that elicits DNS injection that is then used to study censorship
(Pearce et al., 2017b; Niaki et al., 2020b; Hoang et al., 2021; Farnan et al.,
2016; Weinberg et al., 2021). _Monocle_ studies these protocols globally in
the context of ECMP routing.

Equal-cost Multi-path (ECMP) Routing.Equal-cost Multi-path (ECMP)
RoutingEqual-cost Multi-path (ECMP) Routing. Load Balancing is widespread on
the Internet. Augustin et al. (Augustin et al., 2006) explored multi-path
routing in traceroute measurement, and subsequently (Augustin et al., 2010)
found that close to 72% of the (source, destination) pairs experienced some
form of load balancing. Recently Vermeulen et al. (Vermeulen et al., 2020)
found 18% of ECMP routing path divergences span multiple ASes. Routers use
different components of Internet Layer (IP) and Transport Layer (TCP and UDP)
like the source and destination IPs, source and destination ports, etc, to
perform these routing decisions. Routers are also known to use various bits of
the source/destination IP and port to make decisions on which up-link to send
packets (VMWARE, 2020; Cisco, 2007). Thus any IP measurements are subject to
load balancing.

Variance in Censorship Results.Variance in Censorship ResultsVariance in
Censorship Results. Prior censorship studies have noted country/ISP level
inconsistency in DNS, HTTP, and HTTPS measurements (Pearce et al., 2017b;
Raman et al., 2020b; Wang et al., 2017; Crandall et al., 2007; Weinberg et
al., 2021; Anonymous, 2014; Wright, 2014; Xu et al., 2011; Katira et al.,
2023; Yadav et al., 2018; Gill et al., 2015; Winter and Lindskog, 2012; Ensafi
et al., 2015). Pearce et al. (Pearce et al., 2017b) observed differences in
DNS manipulation across resolvers _within_ a country. Raman et al. (Raman et
al., 2020b) noticed sporadic blockpage injection within ISPs and
organizations. Wang et al. (Wang et al., 2017) noticed that for a small
percent of their experiments, they were successful in bypassing the GFW
without any evasion strategy. Crandall et al. (Crandall et al., 2007) in as
early as 2007 observed that on 28.3% of destinations (in China) they observed
no filtering, and even on the paths they _did_ , filtering appeared to be
volatile during high-load periods of the day. Rambert et al. (Weinberg et al.,
2021) noticed differing levels of censorship depending on the source and
destination of the probes (independent of geography). Anonymous (Anonymous,
2014) showed the presence of different injecting interfaces with changing
source IPs. Wright et al. (Wright, 2014) and Xu et al. (Xu et al., 2011) both
highlight geographic variation in censorship implementation across the country
of China, with different provincial ISPs performing their own filtering (in
addition to filtering at the border). Aryan et al. (Aryan et al., 2013)
speculate that individual ISPs can potentially implement their own blocking
mechanisms in addition to centralized blocking (in Iran). Nisar et al. (Nisar
et al., 2018) showed differing blocking implementation by ISPs and differences
even within ISPs in Pakistan. Both Yadav et al. (Yadav et al., 2018) and
Katira et al. (Katira et al., 2023) observed differences in censorship (in
terms of domains censored) across different ISPs tested in India. Gill et al.
(Gill et al., 2015) observed changes in measured censorship: across time, ISPs
(within the same country), and even URLs within the same ISP in several
countries. Winter et al. (Winter and Lindskog, 2012) found that certain Tor
relays remained reachable from VPSes in China even after several days of the
first Tor connection request from the VPS while a majority of them were
blocked. Ensafi et al. (Ensafi et al., 2015) when studying China’s GFW
behavior with respect to Tor found that GFW’s failure (to block Tor) were both
persistent with routes _and_ sporadic.

While country and ISP-level variation in censorship has been globally
observed, there are numerous suspected caused of such variation. These causes
include (but are not limited to): geographical differences in blocking (Pearce
et al., 2017b; Wright, 2014; Xu et al., 2011), constantly changing blocking
methods (Raman et al., 2020b), differing ISP implementations (Nisar et al.,
2018; Gill et al., 2015; Katira et al., 2023; Yadav et al., 2018), network
load (e.g., time-of-day) on censoring devices (Crandall et al., 2007; Ensafi
et al., 2015), and selection of source/destinations (Weinberg et al., 2021).
We stress that while the goal of this work is to understand the influence of
ECMP routing on censorship variation, we do not believe that all previously
observed censorship variation is ECMP-induced.

Bhaskar et al. (Bhaskar and Pearce, 2022) first explored the role of routing
on the Chinese DNS censorship system. Their study found that varying source IP
and port has an impact on the path taken by packets and subsequently
influenced the measurement of China’s Great Firewall (GFW). What remains
unclear from prior work is if the observed behaviors are an isolated artifact
of the GFW and DNS injection, or a broader behavior across the Internet and
censorship measurement at-scale. Our work seeks to expand and generalize this
prior work by systematically exploring the wider effects of ECMP routing on
censorship globally, across both countries and various protocols. We seek to
quantify _why_ this behavior exists pervasively across the Internet, occurring
in disparate countries that lack coordination, consistent network topologies,
or common technical measures.

##  3\. Method

Figure 1.  _Monocle_ , our system to understand impact of routing on
censorship measurement across countries and protocols.

We seek to understand the impact of ephemeral parameters such as source IP
(with a subnet) and source port—and hence Flow-ID—on censorship measurement
globally (Pearce et al., 2017b, a; VanderSloot et al., 2018; Raman et al.,
2020b; Sundara Raman et al., 2020). _Exhaustively_ identifying censorship is
neither ethical nor our objective, but rather our goal is replicating
established methods from prior studies and understanding whether outside-in
censorship measurement methods are affected by ECMP routing.

We develop _Monocle_ (Figure 1) to explore 3 commonly censored protocols (Gill
et al., 2008): DNS, HTTP, and HTTPS. Across these protocols _Monocle_ looks at
multiple known censorship techniques: DNS manipulation (Pearce et al., 2017b),
RST packet injection (Pearce et al., 2017a), packet drops (Ensafi et al.,
2014; Aryan et al., 2013), and blockpages (Raman et al., 2020b; Jones et al.,
2014). _Monocle_ extends measurement methods from prior studies to create
route-stable censorship measurements, enabling us to measure the impact of
packet parameters on censorship.

###  3.1. Approach

Censorship measurement involves sending sensitive payloads between hosts that
trigger a censor, and _inferring_ censorship from responses (or lack thereof).
_Monocle_ implements outside-in censorship measurements by sending route-
stable sensitive TCP and UDP packets, varying source IP across a single /24
network as well as source ports, and observing responses.

TCP-based censorship..TCP-based censorship.TCP-based censorship.. TCP
censorship works by identifying _connections_ to censor, then leveraging
termination or hijacking to disrupt communications. Censors use Host: header
in HTTP or the SNI field (as part of the client-hello) in HTTPS connections to
perform censorship, both of which are well studied (VanderSloot et al., 2018;
Weaver et al., 2009; Ensafi et al., 2015; Nabi, 2013; Clayton et al., 2006;
Bock et al., 2021b; Chai et al., 2019; Bock, 2020; Raman et al., 2020b;
Gatlan, 2019). To disrupt communications, TCP censorship techniques include
RST injection, packet drops, and blockpages (Joseph Lorenzo Hall, 2014).

_Monocle_ establishes TCP connections with destination IPs inside a censored
country from a vantage point outside the country and sends a packet with
keywords—either embedded in the Host:  header of a HTTP GET request or SNI
field of a HTTPS client-hello request—and recording the responses to measure
censorship. A key aspect of _Monocle_ not seen in prior work is controlling
all aspects of generated packets that are known to change Flow-ID, thus
allowing us to perform route-stable censorship measurements. We perform trials
with control and sensitive domains to establish measurement reliability. We
test destinations that have ports 80 for HTTP and 443 for HTTPS, open. We
identify candidate IPs via Censys (Durumeric et al., 2015) and then confirm
their status.

To identify RST based censorship we look for the presence of RSTs in our
response packets in addition to _no_ RSTs from control measurements. To
identify packet drop based censorship we look for the absence of a payload
response in addition to the presence of a payload response for the controls.
Differentiating true censorship from network phenomena for both these forms of
censorship can be challenging as: 1) RST packets can occur for reasons
unrelated to censorship, 2) lack of RST packets or payload response can occur
due to packet loss, and 3) transient censorship failures can cause RST packets
to be missing or payload responses to appear.

To disambiguate censorship from network behavior we perform repeated
measurements separated by a fixed time interval. We note a significant time
interval needed to ensure the tuple can be reused by the remote operating
system. We use 30 minutes, which is 15x longer than the RFC recommendation
(transmission control, 1981) and significantly longer than needed based on our
experiments. We note long-lived residual censorship (Bock et al., 2021a)
beyond 30-minutes is not a concern, since our goal is to study routes, not
censor activity. We only consider a result censorship for a particular
(destination, source) parameter if: 1) we obtained a RST for all the
repetitions and _no_ RST for any of the control measurements, or 2) we
obtained _no_ payload responses for any of the repetition and responses for
all the control measurements. We only consider a result _not_ censorship if
across all repetitions: 1) no RST packet was observed for RST based
censorship, or 2) payload responses were obtained for packet drop based
censorship. We exclude all other results. This approach is _conservative_ , as
it gives us a lower bound of possible true-positive results, discarding
potential differences due to network changes, packet loss, etc. i.e., this
approach gives us a set of differences we have high confidence are routing-
induced, rather than transient effects. Other phenomena and instances of
routing-induced censorship differences may very well exist and be excluded by
this method due to transient network effects, but our results will still
provide a lower-bound.

Blockpages are detected by conducting a manual study of censorship in each
country to extract blockpage templates that are then matched against
responses. This manual operation ensures matches with no false positives but
possible false negatives. This is acceptable, as it provides a lower bound on
our findings on routing-induced censorship changes, rather than exhaustive
censorship measurement. The lack of a blockpage could also be attributed to
similar causes as the lack of a RST packet. To account for this we perform
similar repetitions and consider a result valid when there is consistency
across all iterations.

UDP-based censorship..UDP-based censorship.UDP-based censorship.. For UDP
censorship, _Monocle_ extends prior work (Bhaskar and Pearce, 2022). We send
route-stable sensitive and control DNS A? queries to destinations globally
that _do not_ operate DNS resolvers and record all responses. Censorship
occurs when we obtain a response to a sensitive query, but not the control.

Improving Result Reliability..Improving Result Reliability.Improving Result
Reliability.. Across all experiments we use a combination of control
measurements and repetition separated by fixed time intervals to obtain
reliability. We only consider censorship present or absent for a particular
experiment if the relevant behavior is present across all repetitions in
addition to consideration of control experiments. This stabilizes our results
by eliminating factors like packet loss, residual censorship, and transient
behaviors that may appear as censorship changes. It is possible that within
the time-frame of our repetitions network topologies may change, resulting in
a missed non-censorship result. This is acceptable as our goal is to have a
lower bound on censorship changes.

Route-Stable, Per-Protocol Traceroute..Route-Stable, Per-Protocol
Traceroute.Route-Stable, Per-Protocol Traceroute.. Beyond simple observed
censorship differences, we also seek to understand _why_ these differences
occur, which requires constructing the routes taken by _specific_ packets with
_specific_ parameters. Common prior traceroute techniques are built on UDP,
TCP-based methods use SYN packets, and purpose built censorship traceroute
techniques (Raman et al., 2022) do not control for Flow-ID. For our usage we
need to measure the path of _specific_ sensitive packets with full control
over all aspects of the packets; no tools allow reconstructing routes of a
specific user-controlled packet. Further, for TCP, the sensitive packet is
sent after establishing a TCP connection, thus we must iterate the TTL of the
payload packet of an active connection. This is challenging as we cannot
control retransmission or TCP state from user space. Thus we develop a route-
stable traceroute tool to measure the path taken by packets for all protocols
we explore. We control all fields in the packet that influence routing,
varying the TTL of a given sensitive packet, and build the path using ICMP
responses.

In lieu of implementing a TCP stack in user-space to vary TTLs of mid-flow
sensitive packets, _Monocle_ leverages a combination of Netfilter nfqueues
(Westphal, 2016) and firewall rules. Our firewall redirects outbound packets
we seek to traceroute to an nfqueue, and our nfqueue hook sends copies of the
packet at incrementing TTLs. Kernel retransmission attempts are dropped until
the traceroute is complete or the connection is terminated by the endpoint or
censor. This technique ensures: 1) we can capture the actual path taken by the
packets, and 2) it can be applied to any censorship measurement technique.
With this technique the connection does not need to be torn down after each
TTL attempt, as the packet does not reach the end-host until the end of the
trace. We embed the TTL in the IP ID field of the packet to disambiguate
responses. We note the IP ID field is not known to be used for Flow-ID
(Augustin et al., 2006), and does not influence route. We extract the source
parameters and TTL from the packet embedded in the ICMP response to build the
network path.

###  3.2. Ethical Considerations

Measuring Internet censorship requires careful consideration of the ethical
implications of all experiments, and weighing those implications against the
potential benefits of the understanding gained from the experiment. We build
our ethical framework around the models from prior censorship measurement
works (Bhaskar and Pearce, 2022; Pearce et al., 2017a, b), who in turn modeled
their work after the Belmont (belmont, [n. d.]) and Menlo (Dittrich and
Kenneally, 2012) reports. Namely, we consider the concepts of _justice_ ,
_respect for persons_ , _beneficence_ , and _respect for law and public
interest_. Broadly speaking, these principles dictate that censorship
measurement researchers should strive to: 1) Ensure those who bear the risk of
the work are also the work’s beneficiaries, 2) Given the impossibility of
obtaining informed consent, seek to _minimize_ risk, 3) Ensure that no
experiments stress the infrastructure or users’ machines.

We call attention to _beneficence_ which deals with experimentation that has
inherent risks and speaks to the need to reduce risk to the extent such that
the benefits of conducting the measurements outweigh the risk. Prior
censorship measurement (Pearce et al., 2017b, a; Bhaskar and Pearce, 2022)
discussed this concept. e.g., “In lieu of attempting to obtain informed
consent, we turn to the principle of beneficence, which weighs the benefits of
conducting an experiment against the risks associated with the experiment.
Note that the goal of beneficence is not to eliminate risk, but merely to
reduce it to the extent possible.” (Pearce et al., 2017b).

Guided by these principles, we reduce risk by: 1) significantly down sampling
measurement vantage points to a minimum set per autonomous system necessary to
show the effect of ECMP on censorship measurement, 2) measuring only a single
censored domain per host (the same domain across an entire country) which we
manually selected to minimize potential harm (e.g., by excluding terrorism or
similar categories), 3) only conducting remote measurements that do not result
in follow-on host-initiated communication with censored domains or IPs, and 4)
we rate-limit and randomize experiments to minimize load on any machine.

We note that the benefits of this work include providing the community with
the knowledge of how to conduct sound censorship measurement, which will
enable us to develop tools that better understand censorship globally, with
fewer measurements. Such understanding in-turn enables the development of
better circumvention technologies, and aids policy makers and activists; all
benefits which impact the population that bears the risk of the experiments.

##  4\. Research Questions and Experiments

We begin by enumerating our research questions, and then defining the
experiments we designed and datasets we collected to answer them. We seek to
answer these questions across protocols, censorship techniques, and countries:

  * •

RQ1: What is the path diversity of censorship measurements?

  * •

RQ2: What is the impact of ECMP routing on censorship measurement results?

  * •

RQ3: Why and how much do different packet parameters influence censorship
measurement?

  * •

RQ4: What are the underlying network structures that cause changes in
censorship?

  * •

RQ5: How do these results contextualize with specific prior works?

These research questions build on one another, beginning with an exploration
of the impact of varying source parameters (and thus Flow-ID) on the path
measurement packets take to vantages globally, regardless of censorship, and
then observing this impact on censorship results. We then perform a deeper
analysis to understand the different reasons that cause such variation. We end
with trying to understand the applicability of such variation on prior
censorship measurement studies, and its potential impact on two specific
studies. All experiments were conducted from a purpose built /24 scanning
network at an academic institution in North America, using the methods from
Section 3.

###  4.1. RQ1: What is the path diversity of censorship measurements?

In RQ1 we explore how varying censorship measurement packet source IP and
source port changes paths across countries and protocols, absent censorship.
The goal in exploring this question is quantifying the extent to which
different parameters result in different routes, which is a prerequisite for
ECMP censorship measurement differences. To answer this, we conduct route-
stable HTTP, HTTPS, and DNS traceroute measurements (Section 3.1) with a
control domain to a geographically diverse set of vantage points in various
countries. Across measurements we either fix source parameters, vary an
individual parameter, or vary both parameters (Bhaskar and Pearce, 2022).

Destination IPs..Destination IPs.Destination IPs.. To understand the impact of
packet parameters on route, we select a diverse set of measurement IPs within
each country. Starting with a list of all possible destinations for each
protocol, we use Censys (Durumeric et al., 2015) data to extract destinations
with port 80 open for HTTP, port 443 open for HTTPS and port 53 _not_ open for
DNS). We then pick one destination per AS for each country tested. The number
of destinations selected will vary for each country.

Domain..Domain.Domain.. As our goal in this scenario is to measure the
variation in packet path in different censorship measurement scenarios and not
to perform censorship measurement, we perform measurements with a known benign
domain (example.com). The advantage of this is twofold: (1) keeping with our
ethical considerations, we reduce risk to individuals by using benign domains
when possible, and (2) we avoid any side-effects from censorship activity that
could possibly alter the state of open connections used for traceroute (e.g.,
RST packets that tear down active connections).

Parameter Variation.Parameter VariationParameter Variation. When selecting
source IPs and ports, we conduct four variations of the following experiments:

  * •

Everything Constant.  We repeat the experiment 144 times, replicating
experiments from censorship measurement tools across DNS, HTTP, and HTTPS
(VanderSloot et al., 2018; Pearce et al., 2017b; Bock et al., 2021b).

  * •

Varying Source Port.  Varying the source port of the measurement packet with
144 randomly selected ports from the ephemeral range and fixing the source IP.

  * •

Varying Source IP.  Varying the source IP of the measurement packet with 144
randomly selected IPs from a _/24_ subnet and using a fixed source port.

  * •

Varying Source IP and Source Port.  Varying both the source IP and source port
of the packet simultaneously. We pick 12 randomly selected source IPs and
source ports, ensuring that we obtain 144 measurements in total.

This four-fold approach gives us the ability to understand the variation of
the path taken by the packet across different individual dimensions and with
them combined. Of note is the need to ensure a consistent total number of
experiments (e.g., 144 experiments vs 12 experiments 12 times), to ensure
comparisons _between_ experiments are apt. We pick 12 based on prior work
(Bhaskar and Pearce, 2022) which found that results stabilized by iteration 12
(Section 4.5 (Bhaskar and Pearce, 2022)).

###  4.2. RQ2: What is the impact of ECMP routing on censorship measurement
results?

Next RQ2 seeks to explore the impact of ECMP routing on the _results_ of
outside-in censorship measurement across protocols, censorship mechanisms, and
countries. i.e., do different routes lead to different censorship results? We
thus conduct an experiment utilizing the methods described in Section 3,
varying different source parameters, across numerous censorship methods and
countries. We do not perform traceroutes for this experiment, reducing packets
and risk.

Country and Domain Selection..Country and Domain Selection.Country and Domain
Selection.. For this experiment our goal is to find all potential countries
with state-sponsored and ISP censorship mechanisms amenable to outside-in
measurement, and an associated sensitive domain that can be used to measure
the same. We do this by performing a preliminary manual exploration on _all_
countries and dependant territories we could identify as having IP addresses
geolocated too. This totaled 249 countries and dependent territories. For
each, we: 1) pick potential sensitive domains using a combination of OONI
(ooni, [n. d.]) and CLBL (Citizen Lab, [n. d.]), and sample destination IPs
(open on 80 and 443, and closed on 53, similar to RQ1) from Censys (Durumeric
et al., 2015), and 2) perform a handful of external censorship measurements to
these destination IPs on the different potential sensitive domains. As a
result of this exploration, we find 21 countries from Europe, Asia, Africa,
and Middle East that were able to be remotely measured. We explore this RQ
with the associated domains that are confirmed to be censored in the target
country. We note that such an approach may not exhaustively find _all_
countries and protocols that are amenable to outside-in measurement, but this
is acceptable, as our goal is to understand and provide a lower bound on the
phenomenon’s generalizability globally, not exhaustively enumerate all
possible scenarios.

Destination IPs.Destination IPsDestination IPs. For this experiment, for each
country, we select a set of geographically diverse destination IPs to get an
accurate picture of the change in censorship due to ECMP routing. The criteria
we look for in a destination IP are unchanged from RQ1: open on 80 and 443,
and closed on 53. These criteria allow us to perform measurements across
protocols HTTP, HTTPS, and DNS on the same IP. From this usable set of IPs
(identified from Censys (Durumeric et al., 2015)), we sample up to 60
destinations per AS, depending on the volume of ASes and available IPs for
each country. AS mapping is performed with the RouteViews prefix-to-as dataset
(CAIDA, [n. d.]).

Source Parameters..Source Parameters.Source Parameters.. We use 208 source IPs
selected from a single /24 subnet (excluding .0 and .255), and 8 source ports
randomly selected from the ephemeral port range. We ensure that the source IPs
are normally distributed with respect to their lowest 3 bits, which is
relevant for quantifying some load balancing (Cisco, 2021).

###  4.3. RQ3: Why and how much do different packet parameters influence
censorship measurement?

RQ3 seeks to understand whether particular source parameters (IP or port) have
a noticeable impact on variation in censorship results caused by ECMP routing,
i.e., do some source IPs/ports have a greater impact than others? Exploring
this begins to sheds light _why_ , from a packet perspective, differences
occur, and potentially identifies different ECMP algorithms that use different
parts of the packet to perform routing. We use measurements from RQ2’s
experiments to answer this question and explore impact across source IPs,
source ports and their combinations.

###  4.4. RQ4: What are the underlying network structures that cause changes
in censorship?

Next RQ4 explores different underlying causes for ECMP routing induced
censorship differences. i.e., is ECMP routing causing sensitive packets to
route around censorship, traverse through failed censoring nodes, or pass
through completely different geographical locations with different censorship
behavior? To answer this question we conduct route-stable traceroute
measurements (Section 3.1) to produce network graphs which we use to answer
this question. We describe the dataset used subsequently:

Destinations and Sources.Destinations and SourcesDestinations and Sources. We
use the measurements of RQ2 to sample destinations for all countries/protocols
that exhibit variation and produce network graphs for those source parameters
(Section 3.1). We select destination and source parameter combinations that
exhibited consistent, repeatable censorship change.

Our goal is to: 1) qualitatively demonstrate that the differing observed
censorship results are a direct consequence of varying network paths, and 2)
understand and quantify the different underlying effects that contribute to
such variation. We perform this exploration across all censorship methods and
countries from RQ2.

###  4.5. RQ5: How do these results contextualize with specific prior works?

The goal of RQ5 is twofold: 1) to understand the applicability of ECMP routing
on the variation observed in prior studies, and 2) to understand the potential
impact ECMP routing had on 2 specific prior global outside-in censorship
measurement studies. For the later, we focus on censorship differences
unattributed in prior work that could be ECMP routing induced. We stress that
these 2 prior works are not _incorrect_ , but rather effects observed in such
work may be attributable to ECMP routing, rather than other effects. We seek
to understand the impact of ECMP routing induced censorship differences in two
dimensions: 1) can unattributed ambiguity in prior results be potentially
attributed to ECMP routing, and 2) are end-to-end results from prior work
impacted by ECMP routing? We use the measurements of RQ2 to answer this
questions.

When comparing to the 2 prior studies, we make a best-effort to use their
published measurement methods to sample the same amount of destinations from
the same locations, and compare those results with our own. We do not
replicate their _specific_ destinations, due to both the significant time
since their studies were collected during which routes likely changed, and the
dataset of specific IPs not being publicly available. Our formulation is meant
to understand potential impact and scope, rather than identify precise
results.

##  5\. Results

| DNS | HTTP | HTTPS
---|---|---|---
Country |  Methods & Affected? |  Methods & Affected? |  Methods & Affected?
Algeria (DZ) | - | - | Drop+RST | ✓ | Drop | ✓
Bangla. (BD) | - | - | BPage+Drop | ✓ | Drop+RST | ✓
Belarus (BY) | Inject. | ✗ | BPage | ✓ | RST | ✓
China (CN) | Inject. | ✓ | RST | ✓ | RST | ✓
India (IN) | Inject. | ✗ | BPage+RST | ✓ | RST | ✓
Indonesia (ID) | - | - | BPage | ✓ | RST | ✓
Iran (IR) | Inject. | ✓ | BPage+RST | ✓ | Drop+RST | ✓
Jordan (JO) | - | - | RST | ✗ | RST | ✓
Kuwait (KW) | - | - | Drop+RST | ✓ | Drop+RST | ✓
Oman (OM) | Inject. | ✗ | BPage+Drop | ✗ | RST | ✓
Pakistan (PK) | Inject. | ✗ | Drop+RST | ✓ | Drop+RST | ✓
Qatar (QA) | - | - | BPage | ✗ | RST | ✗
Russia (RU) | Inject. | ✓ | BPage+Drop | ✓ | Drop+RST | ✓
Rwanda (RW) | - | - | RST | ✓ | RST | ✓
S. Korea (KR) | - | - | BPage | ✓ | RST | ✓
Syria (SY) | - | - | RST | ✓ | RST | ✓
Turkey (TR) | Inject. | ✗ | RST | ✓ | RST | ✓
Turkmen. (TM) | Inject. | ✓ | RST | ✗ | - | -
UAE (AE) | - | - | BPage | ✗ | - | -
Uzbek. (UZ) | - | - | BPage | ✗ | Drop+RST | ✗
Yemen (YE) | - | - | RST | ✗ | RST | ✗

Table 1.  Impact of ECMP routing on censorship measurement. 17 out of the 21
countries show changes in due to route. ✓ denotes changes, ✗ denotes no
changes, and - denotes no such externally measurable censorship.

We now explore results from the experiments outlined in Section 4, focused on
answering the five motivating research questions. Table 1 provides an overview
of results from our study detailing the censorship explored for each country.
We find 17 out of 21 countries explored that perform externally measurable
state-level censorship are subject to variation in observed censorship results
due to ECMP.

###  5.1. RQ1: What is the path diversity of censorship measurements?

Figure 2. _Normalized Distribution of Number Of Paths for all destinations._
Marker size represents number of experiments across all destinations that had
the particular _Number of Paths_. We observe that the variation in path has
two observable modes, constant parameters vs varied parameters, and that
source IP has a greater impact on network path variations than varying source
port. We also observe different modes within a particular country (e.g., Iran)
potentially indicating destination port-specific based load balancing.

We aim to understand if varying networking paths leads to changes in
censorship measurement globally, across protocols and ports. We employ the
metric of Number of Nodes and Number of Paths to capture variation in network
path. Number of Nodes, for a destination is a _set_ of all unique router hops
in the network path across all experiments. A _path_ is defined to be a set of
all nodes for a particular combination of destination and source parameters.
Number of Paths is thus a count of the set of all paths for a destination.

This form of ECMP routing within a country potentially depends on the network
infrastructure of the country and its ISPs. Additionally, as packets pass
through several different infrastructures to reach a destination, they pass
through several different ASes (Vermeulen et al., 2020) with potentially
different network infrastructures that can influence their path. Similarly
routing may differ based on destination port (Augustin et al., 2006), causing
different protocols to result in different routing.

Figure 2 shows results from these experiments (Section 4.1) and the variation
in network path as a function of varying different source parameters part of
the Flow-ID. Results are represented as the (normalized) distribution of the
_Number of Paths_ for the experiments conducted for each country and protocol.
For space we abbreviate the number of countries shown to a characteristic
subset. Appendix A shows similar results for Number of Nodes.

For the experiment where we fix source parameters and repeat the measurement
(144 times), we see that there is very little to no variation in the network
path. The mean _Number of Paths_ remained $\leq$ 3 across all the different
protocols tested in different countries. This observation aligns with
expectations and prior work (Bhaskar and Pearce, 2022) and holds for a larger
set of protocols and countries. Although the path remains constant across
repetitions most of the time, there can be subtle variation over time in some
cases (e.g., TR and IR with DNS). We find that repeating the experiments with
the same source parameters does not frequently exercise different network
paths.

Figure 2 shows that varying the different source parameters (independently and
together) yields notably different behavior in the network path variation
among different countries. For a (country, protocol), we observe two general
modes in the observed variation: 1) varying source IP has a greater effect on
the network path than varying source port (e.g., CN & IR), and 2) varying
source IP/port seems to have a similar effect on resulting path density (e.g.,
TR). In addition, we see modes in the observed variation pointing to different
infrastructure (e.g., IR, TR, CN), highlighting the need for both source IP
and port variation.

Apart from variation between countries, we also observe variation in path
diversity across _different protocols_ within the same country. In the case of
Iran, we see that the distribution of _Number of Nodes_ varies between HTTP,
HTTPS & DNS. We hypothesize this steams from destination port also being used
for ECMP routing, opening the door to differences in censorship measurement
based solely on port. All told, we note the significance in path diversity in
censored countries due to source parameters indicates censorship variations
are possible, explored next.

###  5.2. RQ2: What is the impact of ECMP routing on censorship measurement
results?

RQ1 established that varying fields contributing to Flow-ID impacts the
network path taken by a censorship measurement packet for numerous protocols
across various countries. We now look at ECMP routing’s impact on observed
censorship results globally. For this experiment we selected a small number of
destinations per AS per country (Section 4.2). Per our ethical framework
(Section 3.2), our goal is to limit our measurements while still confirming
the existence of the phenomenon. We then conduct measurements across different
protocols with the same set of destinations and source parameters, for one
control domain and one sensitive domain specifically picked to exercise
censorship in the country. We use the methods described in Section 3 to
identify the presence or absence of RSTs, intentional packet drops, blockpage,
or DNS based censorship. We then identify destinations that produce different
observed censorship for different sets of source parameters.

Country | Protocol |  | Destinations
---
(ASes)
| Destinations
---
(ASes) Affected
Algeria | HTTP | 311 (4) | 2% (25%)
HTTPS | 288 (5) | 3% (40%)
Bangladesh | HTTP | 743 (119) | 41% (58%)
HTTPS | 750 (122) | 37% (54%)
Belarus | HTTP | 1094 (13) | 12% (31%)
HTTPS | 1049 (10) | 11% (20%)
| DNS | 2501 (289) | 25% (46%)
China |  HTTP 111 During our study a significant change to China’s GFW was deployed, resulting in a new form of reactive blocking (gfw report, 2022), impacting our ability to measure ECMP routing in China. Thus we present partial results for HTTP and HTTPS predating the change. | 210 (64) | 23% (21%)
|  HTTPS 1 | 948 (217) | 69% (71%)
India | HTTP | 3289 (87) | 99% (99%)
HTTPS | 3316 (90) | 100% (100%)
Indonesia | HTTP | 974 (78) | 84% (71%)
HTTPS | 979 (80) | 84% (68%)
| DNS | 1774 (127) | 9% (26%)
Iran | HTTP | 1351 (142) | 2% (2%)
| HTTPS | 1347 (139) | 9% (20%)
Jordan | HTTPS | 231 (4) |  $<$ 1% (25%)
Kuwait | HTTP | 1188 (15) | 91% (80%)
HTTPS | 70 (11) | 90% (82%)
Oman | HTTPS | 842 (15) | 2% (7%)
Pakistan | HTTP | 373 (52) | 15% (18%)
HTTPS | 704 (93) | 44% (62%)
Russia | DNS | 105 (33) | 65% (46%)
HTTP | 1808 (327) | 66% (47%)
HTTPS | 2526 (362) | 15% (20%)
Rwanda | HTTP | 23 (1) | 92% (100%)
| HTTPS | 54 (1) | 75% (100%)
South Korea | HTTP | 951 (44) | 17% (44%)
HTTPS | 391 (29) | 2% (4%)
Syria | HTTP | 154 (1) | 14% (100%)
HTTPS | 152 (1) | 15% (100%)
Turkey | HTTP | 526 (36) | 21% (34%)
HTTPS | 410 (33) | 18% (31%)
Turkmenistan | DNS | 643 (1) | 5% (100%)
Table 2. RQ2 Summary. Given are number of censored destinations studied
(number of ASes in parentheses) and percent impacted by ECMP; impact varies
significantly by context.  Figure 3. CDF of percent of (source IP, source
Port) combinations per destination for which we observed no censorship.
Measurements are limited to the subset of destinations where variation is
observed in Table 2. We observe that 1) the percent of source parameters that
produce no censorship for the median affected destination varies significant
by country and protocol. 2) HTTP and HTTPS follow very similar trends in how
source parameters affect their results in some countries (BD, BY, IN, & ID)
while in others, they vary significantly (RU, KW) and 3) DNS is affected least
by source parameters.

We find that censorship measurement from 17 out of 21 countries are affected
by ECMP routing, with 34 out of 49 contexts impacted. Table 1 provides results
across all countries and protocols. We find that the extent of impact varies
significantly with country and protocol, ranging from 99% to 1% of
destinations (depending on country) affected for HTTP, from 100% to $<$1% of
destinations affected for HTTPS, and from 65% to 5% of destinations affected
for DNS. Table 2 provides a breakdown of these results. Routing impact not
only varies for different countries, but also for different protocols within a
country. e.g., Iran shows differences across 2%, 9%, and 8% of destinations
for HTTP, HTTPS, and DNS respectively. Such comparison among protocols
supports the hypothesis of different underlying censorship infrastructures
possibly deployed at different locations in addition to ECMP routing affecting
protocols differently. We speculate our observed lower Chinese DNS censorship
impact compared to prior work (Bhaskar and Pearce, 2022) is due to our use of
fewer parameters. Appendix B shows overlap across protocols.

####  5.2.1. Prevalence of Source Parameters Yielding Changes

We now explore measurements for each of the censorship protocols across the
different countries, by number of destinations and source parameters. We seek
to understand the prevalence of parameters leading to changes in censorship
responses in order to gauge the expected impact of ECMP routing on censorship
measurement. e.g., do many, or only a few parameters, impact results?

(a)

(b)

(c)

(d)

(e)

(f)

Figure 4. _Influence of Source IPs and/or Ports on Changes in Censorship._
Sources and destinations are sampled uniformly across the lowest 3 bits, and
colored based on those bits for either source or destination IPs. X-Axis
sorted.

Figure 3 shows a CDF of (Source IP, Source Port) combinations that demonstrate
no censorship, across varying destinations, broken out by country and
protocol. We limit this measurement to destinations that experience variation
in Table 2. We observe that the per destination impact of ECMP routing varied
broadly by country. With the percent of (source IP, source Port) that observed
no censorship for the median _affected destination_ ranging from 93% in the
case of KW (HTTPS) to as low as 1% in the case of CN (HTTP). This calls for
careful selection of measurement parameters.

We also observe modal phenomena. For example, in ID (HTTP and HTTPS) for
nearly $\sim$70% of the destinations that are affected, $\sim$48% of the
(source IP, port) combinations produced no censorship. We see similar patterns
in BD with the split being at $\sim$40% of the source parameters, in BY with a
split at around 10%, in RU (HTTP) with a split at 50%, and also patterns in IN
and RW. We speculate this could be routing algorithms that divide traffic
based on some fixed function of the packet, with some paths lacking
censorship.

We also observe that while for some countries the pattern of per-destination
impact follow similar trends for protocols within the country (e.g., HTTP &
HTTPS with BD, BY, IN, & ID), in others, the pattern varies even among
protocols (e.g., HTTP vs HTTPS RU). It is interesting to note that while HTTP
& HTTPS follow similar trends for most countries, DNS varies the most from the
other two protocols. We speculate that this behavior could be caused by
either: 1) different censorship infrastructure (possibly at different
locations) for each of the protocols, or 2) the destination ports of these
protocols themselves being used in load balancing (Augustin et al., 2006),
yielding different routes and changing censorship infrastructure.

###  5.3. RQ3: Why and how much do different packet parameters influence
censorship measurement?

We now seek to understand how particular source IPs, source ports or the
combination thereof impact censorship variation. To achieve this we perform
analysis on the low-order bit-patterns (known to be used for routing (Cisco,
2021)) of both source and destination IPs compared to observed censorship
variation. Figure 4 shows a breakdown of five modal behaviors, discussed
subsequently. Results are colored by the lowest 3 bits of either source or
destination IP.

(a)

(b)

(c)

(d)

Figure 5.  Network graphs of censored routes (left) and non-censored routes
(right). All nodes are shown in both, only routes change. Blue nodes were
found only in paths that caused censorship, black found only in paths that had
no censorship, yellow found in both, and censoring edges (if found) are red.
We observe notable structural differences between cases.

1\. Particular source IPs see more censorship than others, associated with
specific bit patterns in the source IP.1. Particular source IPs see more
censorship than others, associated with specific bit patterns in the source
IP1. Particular source IPs see more censorship than others, associated with
specific bit patterns in the source IP. Figure LABEL:fig:china-https shows
that based on the source IP selected, the number of destinations that are
impacted by ECMP routing more than double. It was interesting to note that: 1)
we only observed this particular effect with China and the Great Firewall’s
censorship, and 2) the magnitude of lower order bits’ impact flipped in China
(HTTPS), compared to China (DNS) from prior work (Bhaskar and Pearce, 2022).
i.e., 0b000 had the least impact in DNS previously versus most impact in HTTPS
now. This finding is consistent with and further supports the variation
observed by Anonymous (Anonymous, 2014) where they found different injecting
interfaces simply by changing the source and destination of the probes (with
the GFW in China).

2\. Particular source IPs have higher impact than others with no known
associations with source IP bit patterns.2. Particular source IPs have higher
impact than others with no known associations with source IP bit patterns2.
Particular source IPs have higher impact than others with no known
associations with source IP bit patterns. In this case we still see
significant changes in the impact on particular source IPs but cannot directly
attribute them to any source IP bit patterns. We see this particular effect in
Figures LABEL:fig:syria-http and LABEL:fig:kr-http where the impact varies
significantly by source IP, but each country denotes a distinct pattern with
respect to destination IP bits. In addition we observe modal patterns in
Figure LABEL:fig:syria-http which indicate some source parameters are used
differently for ECMP routing, changing censorship.

3\. Uniform distribution of observed changes across the source IPs.3. Uniform
distribution of observed changes across the source IPs3. Uniform distribution
of observed changes across the source IPs. In this case the destination IPs
yield uniformly distributed changes across all source IPs tested, as seen in
Figure LABEL:fig:in-http. This likely indicates hashing to perform ECMP
routing, vs specific bits.

4\. Particular Source IP + Source Port combinations have higher impact than
others.4. Particular Source IP + Source Port combinations have higher impact
than others4. Particular Source IP + Source Port combinations have higher
impact than others. In this case a particular (source IP, source port)
combination produces significantly more variation than others. Figure
LABEL:fig:bd-http shows this, where the number of destinations impacted more
than doubles between two (source IP, port) combinations. This further points
to the need to control both parameters.

5\. Particular Source Ports have greater impact than others.5. Particular
Source Ports have greater impact than others5. Particular Source Ports have
greater impact than others. In this particular case, simply choosing different
source ports has significantly different impacts on the variation in
censorship measurement. We can observe this in Figure LABEL:fig:ir-dns where
the number of destinations impacted by a particular source port can more than
double based on port selection. We note that: 1) we only observed this
behavior in the context Iran, and 2) this directly contrasts prior work
(Bhaskar and Pearce, 2022) which did not observe any variation due to source
port.

###  5.4. RQ4: What are the underlying network structures that cause changes
in censorship?

We have established that routing has a direct impact on the network paths of
packets and subsequently the results of common censorship measurement
techniques. In this section we seek to make qualitative associations between
differing censorship results and potentially deviating network paths as a
result of ECMP routing in an attempt to understand the underlying effects that
cause variation in censorship. To achieve this we perform a deep dive to
understand the concrete causes for such variation across the different
countries and protocols. We find that _such variation is not due to a single
global effect but rather a collection of different effects_ ranging from
routing that appears to exercise failed/misconfigured censoring nodes to
routing that goes through completely different geographical regions that
produce different censorship _en-route_.

We utilize _Monocle_ to perform traceroutes and network graphs (Section 3.1)
for a geographically diverse set of destinations for source parameters that
showed variation, on a per country/protocol basis. Choosing a diverse set of
destinations allows us to study potentially different effects at play even
within a single country. Using these network graphs we find three type of
district effects that contribute to ECMP routing induced observed censorship
variation.

Figure 5 shows network graphs for a representative set of countries and
protocols that demonstrate the different effects. For each destination we
group all experiments that yield censorship into one graph (left) and all
experiments that did not yield censorship into another graph (right). We now
discuss these effects in greater detail in the context of how they manifest in
each of the different countries and protocols. Appendix C contains additional
graphs.

####  5.4.1. Type 1: ECMP routing (Inter-AS or Intra-AS) exercising possibly
failed/misconfigured censoring nodes

Here, the packet is routed from a single node at a particular hop to a series
of different nodes at the subsequent hop, that typically belong to an AS known
to perform censorship. These different nodes often exist in the same /24
subnet and geographic region. _We observe different censorship behavior
because some of these devices/paths perform censorship while others do not_ ,
pointing to potentially failed/misconfigured censoring devices. This was one
of the most commonly observed effects.

Identifying exact failed/misconfigured censoring nodes is challenging without
detailed knowledge of the underlying censoring infrastructure, but we can
infer this from comparing network graphs that have different observed
censorship behavior side-by-side. We do this by identifying particular nodes
in the censoring AS that are _only_ present in the paths (for source
parameters) that _do not_ exhibit censorship, suggesting failure or
misconfiguration.

Inter versus Intra AS.Inter versus Intra ASInter versus Intra AS. When routing
to different nodes in the censoring AS, ECMP routing can take place either: 1)
completely within the censoring AS (Intra AS), _or_ 2) from a completely
different AS to the censoring AS (Inter AS). This highlights that variation in
censorship measurement based on ECMP is not solely due to routing differences
inside censoring ASes, but also stems from routing changes yielding different
ASes before the censoring AS.

We observe this effect in Indonesia (HTTPS), shown in Figure LABEL:fig:id-
https-graph, as the sensitive packet transits from AS3491 (PCCW Global IP in
Singapore) to AS7632 (PT Link Net, ISP in Indonesia known to perform
censorship (OONI, 2017)), it is routed to several different IPs within several
different /24 subnets in AS7632, some of which experience (RST) censorship
while others do not. We also note that these nodes are mutually exclusive for
the two behaviors.

Figure 6. ECMP routing yielding _geographically_ diverse routes. We observe
that the sensitive packet is routed to different cities based on source IP or
port, producing different observed censorship behavior. Censorship is only
observed on Route 1. We note this exemplar is persistent.

We also observe this behavior in: 1) Belarus (HTTP and HTTPS) as the packets
traverse through a set of mutually exclusive paths in AS6697 (Beltelecom, one
of the ISPs known to perform blockpage based censorship (OONI, 2020; Duncan
and Chen, 2023)), where one transits nodes that always produce blockpage
censorship and the other passes through nodes with no censorship, 2) in
Bangladesh (HTTP) as the packet undergoes ECMP routing from AS6939 (Hurricane
Electric IP in Singapore) or AS2914 (NTT America IP in Singapore), to several
different IPs in AS58717 (Summit Communications, a major ISP in Bangladesh
known to perform censorship (OONI, 2022)), some of which perform
blockpage/drop censorship, while others do not, 3) in Bangladesh (HTTPS) where
ECMP routing entirely within AS17494 (BTCL, a large ISP in Bangladesh) causes
the sensitive _client-hello_ to pass through certain nodes that never
experience censorship while others that always produce RST censorship, 4) in
Turkey (HTTPS), as the sensitive packet transits from AS1299 (Arelion Sweden
IP in Germany) to AS9121 (Turk Telekom, ISP in Turkey known to perform
censorship (Jin et al., 2021)), it is routed to different IPs is the same /24
subnet in AS9121. On some of these paths, the sensitive packet experiences
censorship while on others it does not, and 5) in South Korea (HTTP) where the
packet transits from AS9848 (Sejong Telecom) to AS4670 (Shinbiro), the packet
takes two distinct paths going into AS4670; on one path the sensitive packet
produces a blockpage while on the other it passes through to the destination
and we get the response from the server. Although AS4670 is not known to
perform censorship, it has customers (e.g., AS9848) that censor (Hoang et al.,
2019).

Such per-destination variation (presence or absence) of measured censorship
due to source parameters causing the packet to pass through potentially
failed/misconfigured censoring nodes could possibly manifest as non-uniform
censorship across different destinations within a country/ISP, which could be
a contributing factor in variation observation in prior work (Pearce et al.,
2017b; Wang et al., 2017; Crandall et al., 2007; Weinberg et al., 2021; Gill
et al., 2015; Winter and Lindskog, 2012; Ensafi et al., 2015; Raman et al.,
2020b).

####  5.4.2. Type 2: ECMP routing through geographically different regions
with different censorship behavior

Here packets are routed from a particular AS to a fixed endpoint, but along
the way transit IPs that are in different /24 subnets and are geographically
diverse (but in the same AS). As a result of such persistent substantial
change in the network path we observe different censorship behaviors.
Accounting for such effects is critical for outside-in measurement so as to
not conflate route/path specific censorship behavior as censorship behavior at
the measurement destination.

We observe this in India (HTTP), shown in Figure LABEL:fig:in-http-graph,
where the deviation in path producing differing censorship behavior occurs
when the packet transits _from_ one of: 1) AS6461 (Zayo Bandwidth IP in
London, UK, or in Los Angeles, USA), or 2) AS7473 (Singapore Telecom in
Singapore)- _to_ AS9498 (BHARTI Airtel, known to perform censorship (Gosain et
al., 2018; Singh et al., 2020; Katira et al., 2023)). The IP in AS6461 (or
AS7473) routes the packet on IPs in noticeably different /24s in AS9498,
sometimes in completely different cities simply based on the packet
construction. Some of these paths produce a blockpage while others do not.
Only a handful of routers in AS6461 and AS7473 control the path taken into
AS9498 and consequently if we observe censorship.

Figure 6 demonstrates this geographically diverse _censorship-along-the-way_
effect, with packets between two fixed endpoints taking different paths based
on source parameters, those paths varying geographically (per Ipinfo (ipinfo,
[n. d.])), and censorship correlating to geographic regions within India. Only
a fraction of these paths pass through devices that perform censorship, owing
to larger impact of ECMP on differences in observed censorship in India (Table
2). Prior work found AS-level variation in measured censorship for India
(Katira et al., 2023; Yadav et al., 2018) which highlights the need to account
for such ECMP routing induced censorship changes, and also the possibility
that router regions, rather than end-host regions, are being measured.

####  5.4.3. Type 3: ECMP routing _around_ censorship

In this mode we observe that at a particular hop, the packet undergoes ECMP
routing, causing it to take completely different AS paths before reaching
converging at the destination. Some of these paths never go through the
censoring AS, experiencing no censorship, while others do.

We observed this effect in Kuwait (HTTP, Figure LABEL:fig:kw-http-graph),
where depending on source parameters, the packet either transits directly from
AS3356 (LEVEL3 in London, UK) to AS59605 (Zain Group), reaching the
destination without censorship, _or_ it had unresponsive hops between AS3356
and AS59605, where we observed censorship.

We also observed the effect in: 1) Kuwait (HTTPS) as the packet transits from
a hop in AS3356 (LEVEL3, IP in UK), it either passes through several
unresponsive hops leading to an IP in AS47589 (Kuwait Telecom, known to
perform censorship (Hoang et al., 2019)), where it terminates producing
censorship, _or_ transits directly to another IP in AS47589 eventually leading
to the destination and no censorship occurs, and 2) Rwanda (HTTP) as the
packet transits from AS16637 (MTN SA IP in Kenya) we observe two mutually
exclusive paths, one that transits to another AS16637 IP in SA then AS36890
(MTN Rwandacell, large ISP in Rwanda) before reaching the destination, another
that passes through a set of non-responsive hops and reaches the destination.
The former path that passed through AS36890 always experiences censorship,
while the latter does not.

Such per-destination variation in censorship caused by simply changing source
parameters resulting in completely different AS paths not experiencing
censorship _can also_ manifest as non-uniform country/ISP level, which could
be a contributing factor in variation observation in prior work (Pearce et
al., 2017b; Wang et al., 2017; Crandall et al., 2007; Weinberg et al., 2021;
Gill et al., 2015; Winter and Lindskog, 2012; Ensafi et al., 2015; Raman et
al., 2020b).

####  5.4.4. Type 4: Behavior that is unknown or cannot be directly attributed
to variation in path

In this scenario the changes in censorship results cannot be directly
attributed to an observable change in path. This could occur due to different
forms censorship infrastructure in the path that do not answer with any ICMP
messages _or_ ones that are completely off-path. We observed this behavior
with Pakistan (HTTP), shown in Figure LABEL:fig:pk-http-graph, as the packet
transits from AS3356 (LEVEL3 IP in France) to AS17557 (Pakistan Telecom, known
to perform censorship (Nabi, 2013; Zuckerman, 2008)), there exists an
unresponsive node where for some source parameters we observe censorship
(packet drops) and for others we do not.

We also observed this behavior in: 1) Iran (HTTP), where both sets of source
parameters have the same network path until they reach an IP in AS58224 (Iran
Telecom) at which point a blockpage is always issued for certain set of source
parameters while there is no censorship for others, and 2) Algeria (HTTP and
HTTPS) where ECMP routing in AS174 (Cogent) produces mutually exclusive sub-
paths (each for a combination of source parameters) that exhibit different
observed censorship behavior. In this case as the packet leaves the border
router in AS174 towards AS36947 (Telecom Algeria), there are several
unresponsive hops before the destination.

####  5.4.5. Result and Route Stability

Our conservative selection criteria specifically controlled for stable routes
(by controlling for Flow-ID, Section 3.1). Additionally, our experiments took
place over a two week window, requiring that the different routes and
corresponding variation results were stable over that time horizon. We then
conducted a spot-check manual exploration approximately 2 months after the
initial experiments of the specific packet parameters and IPs that caused
variation, and found much of the variation remained. This is consistent with
prior work (Paxson, 1997), that while dated, demonstrated that routes tend to
be stable over time.

###  5.5. RQ5: How do these results contextualize with specific prior works?

Figure 7. Simulation of impact of ECMP on a replication of prior work’s (Raman
et al., 2020b) selection method. CDF of percent of (source IP, source Port)
combinations per destination for which _we_ observed no censorship for the
sample set of destinations.

We have qualitatively and quantitatively established the impact of ECMP
routing on global outside-in censorship measurement while also investigating
the underlying causes of such variation. Finally we want to contextualize
prior results in the presence of ECMP. We first look at the applicability of
ECMP router induced censorship changes on the different forms of variance
observed in prior work (enumerated in Section 2). We then focus on specific
findings/results from prior work that are potentially impacted by ECMP routing
(Pearce et al., 2017b; Raman et al., 2020b).

####  5.5.1. Applicability in Prior Work

Section 2 detailed the different forms of country and ISP level
inconsistencies in measured censorship in prior work. Not all of this
variation is ECMP routing induced, with the root causes ranging from clearly
demonstrated different censorship implementations across a country (Wright,
2014; Xu et al., 2011; Nisar et al., 2018; Yadav et al., 2018; Katira et al.,
2023), to network load on censors manifesting as sporadic absences in
censorship (Crandall et al., 2007; Ensafi et al., 2015). We posit however that
the per-destination changes in censorship observed in our results by changing
the source parameters of the sensitive packet, can manifest as non-uniform
censorship at a country/ISP level as observed in prior work (Pearce et al.,
2017b; Wang et al., 2017; Crandall et al., 2007; Weinberg et al., 2021; Gill
et al., 2015; Winter and Lindskog, 2012; Ensafi et al., 2015; Raman et al.,
2020b). While we cannot conclude that ECMP routing is the (sole or
contributing) cause for such variation ECMP routing is applicable to these
methods and studies, and should be accounted for to identify variation root-
causes and stabilize measurements. ECMP routing is also applicable for
external measurements attempting to disambiguate ISP-granularity censorship
differences, since prior work has found concrete evidence of differing
censorship implementation at the ISP/AS-level (Nisar et al., 2018; Yadav et
al., 2018; Katira et al., 2023) and our findings (Section 5.4.2) suggest that
for the same destination, ECMP routing causes the probe to pass through
completely different ASes with different censorship behavior.

####  5.5.2. Potential Impact of ECMP routing on 2 Prior Works

We now look at two prior outside-in studies focusing on: how their
observations can potentially be explained by ECMP routing (Pearce et al.,
2017b), and how their results could be impacted by ECMP routing (Raman et al.,
2020b), based on our results.

Global DNS censorship measurement.Global DNS censorship measurementGlobal DNS
censorship measurement. Our results can shed light on the causes of
heterogeneity in observed censorship seen by prior DNS censorship measurement.
e.g., Figure 7 from Pearce et al. (Pearce et al., 2017b) shows banding effects
at $\sim$10% for Iran and $\sim$20% in China, which they attribute to non-
determinism in censors. When we compare their results to our own, we find that
$\sim$7% of destinations for Iran, and $\sim$25% of destinations for China are
impacted by ECMP routing. While the age of the study and lack of specific
source parameters precludes definitive conclusion, the similarity between
results is consistent with ECMP routing induced censorship differences causing
these banding effects. We note that Pearce et al. measures all forms of DNS
manipulation, whereas we measure only “injected” DNS manipulation, which
limits our comparison.

Global HTTP and HTTPS censorship measurement.Global HTTP and HTTPS censorship
measurementGlobal HTTP and HTTPS censorship measurement. In this case study we
consider the example of a global outside-in censorship study conducted by
Raman et al. (Raman et al., 2020b). We see that they choose either 11 (for
HTTP) or 13 (for HTTPS) destinations per country for their study (from their
Table 1 (Raman et al., 2020b)). To understand the potential impact of ECMP
routing on such a study we randomly sampled 11 (for HTTP) or 13 (for HTTPS)
destinations per country that observed censorship in our experiments for RQ2.
We found that across the countries out of 362 destinations that we sampled,
_138 ( $\sim$35%)_ destinations showed some form of variations in observed
censorship results. For this sample, Figure 7 shows the CDF of percent of
source parameters that no censorship was observed on per destination. We find
that _for a median affected destination, $\sim$47% of source parameters
produced no censorship_. As such, depending on the specifics of multiple
experiments, repeated trials, and specific source parameters used, prior work
may have observed what appeared to be failures or lack of censorship, when in
reality they were observing routing-induced censorship changes.

##  6\. Recommendations and Concluding Discussion

Our work demonstrates the choice of intra-subnet source IP and ephemeral port
influences censorship measurement routes, and those routing changes in turn
impact observed censorship across DNS, HTTP, and HTTPS, globally. We show
these variations are significant in terms of the number of affected countries,
IPs, and source parameters, and explore _why_ such changes exist. We note that
censorship measurement is a critical tool for policymakers and evasion tool
designers, and thus accurate understanding of methods, results, and
confounding factors such as those discussed in this work are important for
_correct_ assessment of information control.

ECMP Routing Impacts Measurement, Globally.ECMP Routing Impacts Measurement,
GloballyECMP Routing Impacts Measurement, Globally. Prior work observed the
Chinese GFW’s DNS injection changing based on routing (Bhaskar and Pearce,
2022), but it was unclear if such behaviors were an idiosyncrasy of that
system or a global phenomenon rooted in routing. We generalize our
understanding of the intersection between routing and censorship measurement,
discovering that ECMP routing’s impact on censorship measurement is both
pervasive and significant. We also observed differences in how particular
source parameters influence censorship results and found not just source IPs
but source ports can have an impact on censorship results. These differences
in changes point to the complexity of routing and distributed systems, and
call for further work in understanding localized observed differences in
censorship measurement globally. We further contextualized results with prior
work and found instances where non-determinism in prior global censorship
measurement is consistent with this phenomenon. We also note that this
phenomenon may impact other forms of measurement, such as fast Internet
scanning.

Causes of Variation..Causes of Variation.Causes of Variation.. We also
explored _why_ variation exists and found several causes: 1) ECMP routing
exercising likely failed or misconfigured censoring devices, 2) ECMP routing
causing a difference in AS path to cause “routing around” censorship behavior,
and 3) ECMP routing causing the packets to traverse completely different
geographical regions, producing different censorship behavior _en-route_. From
this exploration we learn that in addition to diversity in source parameters,
censorship studies must account for potentially observing different censorship
behaviors _along_ the path rather than _at_ the destination, when performing
measurement.

Extending to IPv6 Censorship Measurement..Extending to IPv6 Censorship
Measurement.Extending to IPv6 Censorship Measurement.. IPv6 censorship is
broadly under-studied, irrespective of ECMP routing. Given that prior work
(Almeida et al., 2017) found that ECMP is _more_ prevalent (75% of their
measured routes) in IPv6 than IPv4, we believe that its impact on censorship
measurement could be commiserate. Thus ECMP routing should be taken into
account as a first order concern as nascent IPv6 censorship measurement
studies are conducted. We note that the the presence of the _Flow Label_ field
in IPv6 may aid in methods to produce route-stable censorship measurements.

Recommendations for Future Studies..Recommendations for Future
Studies.Recommendations for Future Studies.. We find that diversity in both
source IP and source port is critical when performing censorship measurement
to avoid potentially incorrect results or what appears to be transient
failures, globally, across protocols. We also note repetition is necessary to
differentiate between _network effects_ and _actual censorship variation_.
Measurements must be repeated with significant parameter diversity, and
localized geographic effects must be validated with route diversity. Finally,
we find significant differences in measured censorship in some countries by
protocol. These differences indicate a need for cross-protocol measurement for
a complete picture of Internet censorship.

Future Work and Evasion.Future Work and EvasionFuture Work and Evasion. Our
work focuses on outside-in measurement that is, by design, external. Future
work aimed at extending these observations to volunteer vantage points within
a country is needed. We however note such work is potentially challenging as
volunteer systems may not have access to numerous IPs, or repeated experiments
may be ethically challenging. Further, the prevalence across both countries
and protocols, as well as the overlap between protocols for given IPs,
suggests the viability of future work leveraging these differences to
construct packets to _route-around_ censorship, thus effectively evading. We
note that Tor Bridges (Matic et al., 2017) are a particularly apt potential
use.

##  7\. Acknowledgements

The authors thank the anonymous reviewers and the shepherd for all their
thoughtful feedback provided during the review process. This work was
supported by funding from the National Science Foundation (NSF) CAREER award
2239183.

## References

  * (1)
  * Almeida et al. (2017) Rafael Almeida, Osvaldo Fonseca, Elverton Fazzion, Dorgival Guedes, Wagner Meira, and Ítalo Cunha. 2017.  A characterization of load balancing on the IPv6 Internet. In _Passive and Active Measurement: 18th International Conference, PAM 2017, Sydney, NSW, Australia, March 30-31, 2017, Proceedings 18_. Springer, 242–254.
  * Anonymous (2014) Anonymous. 2014\.  Towards a Comprehensive Picture of the Great Firewall’s DNS Censorship. In _USENIX FOCI_.
  * Aryan et al. (2013) Simurgh Aryan, Homa Aryan, and J Alex Halderman. 2013\.  Internet Censorship in Iran: A First Look. In _USENIX FOCI_.
  * Augustin et al. (2006) Brice Augustin, Xavier Cuvellier, Benjamin Orgogozo, Fabien Viger, Timur Friedman, Matthieu Latapy, Clémence Magnien, and Renata Teixeira. 2006.  Avoiding traceroute anomalies with Paris traceroute. In _Proceedings of the 6th ACM SIGCOMM conference on Internet measurement_. 153–158.
  * Augustin et al. (2010) Brice Augustin, Timur Friedman, and Renata Teixeira. 2010\.  Measuring multipath routing in the internet.  _IEEE/ACM Transactions on Networking_ (2010).
  * belmont ([n. d.]) belmont [n. d.].  The Belmont Report - Ethical Principles and Guidelines for the Protection of Human Subjects of Research.  http://ohsr.od.nih.gov/guidelines/belmont.html.
  * Bhaskar and Pearce (2022) Abhishek Bhaskar and Paul Pearce. 2022.  Many Roads Lead To Rome: How Packet Headers Influence DNS Censorship Measurement. In _USENIX Security Symposium (USENIX)_.
  * Bock (2020) Dave Levin Kevin Bock. 2020\.  Exposing and Circumventing China’s Censorship of ESNI.
  * Bock et al. (2021a) Kevin Bock, Pranav Bharadwaj, Jasraj Singh, and Dave Levin. 2021a.  Your censor is my censor: Weaponizing censorship infrastructure for availability attacks. In _2021 IEEE Security and Privacy Workshops (SPW)_. IEEE, 398–409.
  * Bock et al. (2021b) Kevin Bock, Gabriel Naval, Kyle Reese, and Dave Levin. 2021b.  Even Censors Have a Backup: Examining China’s Double HTTPS Censorship Middleboxes. In _Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet_. 1–7.
  * CAIDA ([n. d.]) CAIDA. [n. d.].  Routeviews Prefix to AS mappings Dataset (pfx2as) for IPv4.  https://www.caida.org/catalog/datasets/routeviews-prefix2as/.
  * Chai et al. (2019) Zimo Chai, Amirhossein Ghafari, and Amir Houmansadr. 2019\.  On the Importance of Encrypted-SNI(ESNI) to Censorship Circumvention. In _9th USENIX Workshop on Free and Open Communications on the Internet (FOCI 19)_.
  * Cisco (2007) Cisco. 2007\.  Understanding etherchannel load balancing and redundancy on catalyst switches.  https://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html.
  * Cisco (2021) Cisco. 2021\.  LAG Load Balancing on Cisco 350 and 550 Series Switches.
https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-550
/x-series-stackable-managed-switches/1388-LAG-Load-Balancing-on-
Cisco-350-and-550-series-Switches.pdf .

  * Citizen Lab ([n. d.]) Citizen Lab. [n. d.].  Block Test List.  https://github.com/citizenlab/test-lists.
  * Clayton et al. (2006) Richard Clayton, Steven J. Murdoch, and Robert N. M. Watson. 2006\.  Ignoring the Great Firewall of China. In _Privacy Enhancing Technologies Symposium (PETS)_.  http://www.cl.cam.ac.uk/~rnc1/ignoring.pdf
  * Crandall et al. (2007) Jedidiah R. Crandall, Daniel Zinn, Michael Byrd, Earl Barr, and Rich East. 2007\.  ConceptDoppler: A Weather Tracker for Internet Censorship. In _Computer and Communications Security_. ACM, Alexandria, VA, USA, 352–365.  http://www.csd.uoc.gr/~hy558/papers/conceptdoppler.pdf
  * Dittrich and Kenneally (2012) D. Dittrich and E. Kenneally. 2012.  _The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research_.  Technical Report. U.S. Department of Homeland Security.
  * Duncan and Chen (2023) Shawn P Duncan and Hui Chen. 2023.  Detecting network-based internet censorship via latent feature representation learning.  _Computers & Security_ (2023).
  * Durumeric et al. (2015) Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, and J. Alex Halderman. 2015.  A Search Engine Backed by Internet-Wide Scanning. In _ACM Conference on Computer and Communications Security (CCS)_.
  * Elmenhorst et al. (2021) Kathrin Elmenhorst, Bertram Schütz, Nils Aschenbruck, and Simone Basso. 2021.  Web censorship measurements of HTTP/3 over QUIC. In _Proceedings of the 21st ACM Internet Measurement Conference_. 276–282.
  * Ensafi et al. (2014) Roya Ensafi, Jeffrey Knockel, Geoffrey Alexander, and Jedidiah R. Crandall. 2014.  Detecting Intentional Packet Drops on the Internet via TCP/IP Side Channels. In _Workshop on Passive and Active Network Measurement (PAM)_.
  * Ensafi et al. (2015) Roya Ensafi, Philipp Winter, Abdullah Mueen, and Jedidiah R. Crandall. 2015.  Analyzing the Great Firewall of China Over Space and Time.  _Privacy Enhancing Technologies Symposium (PETS)_ (2015).
  * Farnan et al. (2016) Oliver Farnan, Alexander Darer, and Joss Wright. 2016\.  Poisoning the Well – Exploring the Great Firewall’s Poisoned DNS Responses. In _ACM Workshop on Privacy in the Electronic Society (WPES)_.  http://dl.acm.org/authorize?N25517
  * Gatlan (2019) Sergiu Gatlan. 2019\.  South Korea is censoring the Internet by snooping on SNI traffic.
  * gfw report (2022) gfw report. 2022\.  Large scale blocking of TLS-based censorship circumvention tools in China.  https://github.com/net4people/bbs/issues/129.
  * Gill et al. (2008) Phillipa Gill, Masashi Crete-Nishihata, Jakub Dalek, Sharon Goldberg, Adam Senft, and Greg Wiseman. 2008.  Characterizing Censorship of Web Content Worldwide.  Available at http://www.cs.stonybrook.edu/~phillipa/papers/GCDG_May8.pdf.
  * Gill et al. (2015) Phillipa Gill, Masashi Crete-Nishihata, Jakub Dalek, Sharon Goldberg, Adam Senft, and Greg Wiseman. 2015.  Characterizing Web Censorship Worldwide: Another Look at the OpenNet Initiative Data.  _Transactions on the Web_ 9, 1, Article 4 (Jan. 2015), 29 pages.  https://doi.org/10.1145/2700339
  * Gosain et al. (2018) Devashish Gosain, Anshika Agarwal, Sahil Shekhawat, H. B. Acharya, and Sambuddho Chakravarty. 2018\.  Mending Wall: On the Implementation of Censorship in India. In _Security and Privacy in Communication Networks_.
  * Hoang et al. (2019) Nguyen Phong Hoang, Sadie Doreen, and Michalis Polychronakis. 2019\.  Measuring I2P Censorship at a Global Scale. In _9th USENIX Workshop on Free and Open Communications on the Internet (FOCI 19)_.
  * Hoang et al. (2021) Nguyen Phong Hoang, Arian Akhavan Niaki, Jakub Dalek, Jeffrey Knockel, Pellaeon Lin, Bill Marczak, Masashi Crete-Nishihata, Phillipa Gill, and Michalis Polychronakis. 2021.  How Great is the Great Firewall? Measuring China’s DNS Censorship. In _Proceedings of the 30th USENIX Security Symposium_ _(USENIX Security ’21)_.
  * House (2016) Freedom House. 2016\.  Silencing the Messenger: Communication Apps Under Pressure.  https://freedomhouse.org/report/freedom-net/2016/silencing-messenger-communication-apps-under-pressure
  * ipinfo ([n. d.]) ipinfo [n. d.].  IPInfo.IO.  https://ipinfo.io/.
  * Jin et al. (2021) Lin Jin, Shuai Hao, Haining Wang, and Chase Cotton. 2021\.  Understanding the Practices of Global Censorship through Accurate, End-to-End Measurements.  _Proceedings of the ACM on Measurement and Analysis of Computing Systems_ (2021).
  * Jones et al. (2014) Ben Jones, Tzu-Wen Lee, Nick Feamster, and Phillipa Gill. 2014\.  Automated Detection and Fingerprinting of Censorship Block Pages. In _ACM Internet Measurement Conference (IMC)_.
  * Joseph Lorenzo Hall (2014) Ben Jones Nick Feamster Joseph Lorenzo Hall, Michael D. Aaron. 2014.  A Survey of Worldwide Censorship Techniques.  (2014).  https://tools.ietf.org/id/draft-hall-censorship-tech-05.html
  * Katira et al. (2023) Divyank Katira, Gurshabad Grover, Kushagra Singh, and Varun Bansal. 2023.  CensorWatch: On the Implementation of Online Censorship in India.  (2023).
  * Khattak et al. (2014) Sheharbano Khattak, Mobin Javed, Syed Ali Khayam, Zartash Afzal Uzmi, and Vern Paxson. 2014.  A Look at the Consequences of Internet Censorship Through an ISP Lens. In _Proceedings of the 2014 Conference on Internet Measurement Conference_. ACM, 271–284.  http://dl.acm.org/citation.cfm?id=2663750
  * Lowe et al. (2007) Graham Lowe, Patrick Winters, and Michael L. Marcus. 2007\.  _The Great DNS Wall of China_.  Technical Report. New York University.  http://cs.nyu.edu/~pcw216/work/nds/final.pdf
  * Matic et al. (2017) Srdjan Matic, Carmela Troncoso, and Juan Caballero. 2017\.  Dissecting Tor Bridges.  (2017).
  * Nabi (2013) Zubair Nabi. 2013\.  The Anatomy of Web Censorship in Pakistan. In _USENIX Workshop on Free and Open Communications on the Internet (FOCI)_.
  * Niaki et al. (2020a) Arian Akhavan Niaki, Shinyoung Cho, Zachary Weinberg, Nguyen Phong Hoang, Abbas Razaghpanah, Nicolas Christin, and Phillipa Gill. 2020a.  ICLab: A Global, Longitudinal Internet Censorship Measurement Platform. In _2020 IEEE Symposium on Security and Privacy (SP)_ _(Oakland 2020)_. IEEE Computer Society.
  * Niaki et al. (2020b) Arian Akhavan Niaki, Nguyen Phong Hoang, Phillipa Gill, Amir Houmansadr, et al. 2020b.  Triplet Censors: Demystifying Great Firewall’s DNS Censorship Behavior. In _10th USENIX FOCI)_.
  * Niaki et al. (2021) Arian Akhavan Niaki, William R. Marczak, Sahand Farhoodi, Andrew McGregor, Phillipa Gill, and Nicholas Weaver. 2021.  Cache Me Outside: A New Look at DNS Cache Probing. In _Passive and Active Measurement - 22nd International Conference, PAM 2021, Virtual Event, March 29 - April 1, 2021, Proceedings_.
  * Nisar et al. (2018) Aqib Nisar, Aqsa Kashaf, Ihsan Ayyub Qazi, and Zartash Afzal Uzmi. 2018.  Incentivizing censorship measurements via circumvention. In _Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication_. 533–546.
  * Nourin et al. (2023) Sadia Nourin, Van Tran, Xi Jiang, Kevin Bock, Nick Feamster, Nguyen Phong Hoang, and Dave Levin. 2023.  Measuring and Evading Turkmenistan’s Internet Censorship: A Case Study in Large-Scale Measurements of a Low-Penetration Country. In _Proceedings of the ACM Web Conference 2023_. 1969–1979.
  * ooni ([n. d.]) ooni [n. d.].  Ooniprobe: A Network Interference Detection Tool.  https://github.com/thetorproject/ooni-probe
  * OONI (2017) OONI. 2017.  The State of Internet Censorship in Indonesia.  https://ooni.org/post/indonesia-internet-censorship/
  * OONI (2020) OONI. 2020.  Belarus protests: From internet outages to pervasive website censorship.  https://ooni.org/post/2020-belarus-internet-outages-website-censorship/
  * OONI (2022) OONI. 2022.  OONI Explorer.  https://explorer.ooni.org/search?probe_cc=BD&since=2022-11-01&until=2023-11-01&failure=true&only=confirmed&probe_asn=58717
  * Paxson (1997) Vern Paxson. 1997\.  End-to-end routing behavior in the Internet.  _IEEE/ACM transactions on Networking_ 5, 5 (1997), 601–615.
  * Pearce et al. (2017a) Paul Pearce, Roya Ensafi, Frank Li, Nick Feamster, and Vern Paxson. 2017a.  Augur: Internet-Wide Detection of Connectivity Disruptions. In _IEEE Symposium on Security and Privacy (S &P)_.
  * Pearce et al. (2017b) Paul Pearce, Ben Jones, Frank Li, Roya Ensafi, Nick Feamster, Nick Weaver, and Vern Paxson. 2017b.  Global Measurement of DNS Manipulation. In _USENIX Security Symposium (USENIX)_.
  * Raman et al. (2020a) Ram Sundara Raman, Leonid Evdokimov, Eric Wurstrow, J Alex Halderman, and Roya Ensafi. 2020a.  Investigating large scale HTTPS interception in Kazakhstan. In _Proceedings of the ACM Internet Measurement Conference_. 125–132.
  * Raman et al. (2020b) Ram Sundara Raman, Adrian Stoll, Jakub Dalek, Reethika Ramesh, Will Scott, and Roya Ensafi. 2020b.  Measuring the Deployment of Network Censorship Filters at Global Scale.. In _NDSS_.
  * Raman et al. (2022) Ram Sundara Raman, Mona Wang, Jakub Dalek, Jonathan Mayer, and Roya Ensafi. 2022.  Network measurement methods for locating and examining censorship devices. In _Proceedings of the 18th International Conference on emerging Networking EXperiments and Technologies_. 18–34.
  * Ramesh et al. (2020) Reethika Ramesh, Ram Sundara Raman, Matthew Bernhard, Victor Ongkowijaya, Leonid Evdokimov, Anne Edmundson, Steven Sprecher, Muhammad Ikram, and Roya Ensafi. 2020\.  Decentralized control: A case study of russia. In _Network and Distributed Systems Security (NDSS) Symposium 2020_.
  * Ramesh et al. (2023) Reethika Ramesh, Ram Sundara Raman, Apurva Virkud, Alexandra Dirksen, Armin Huremagic, David Fifield, Dirk Rodenburg, Rod Hynes, Doug Madory, and Roya Ensafi. 2023.  Network responses to Russia’s invasion of Ukraine in 2022: a cautionary tale for internet freedom. In _32nd USENIX Security Symposium_.
  * Scott et al. (2016) Will Scott, Thomas Anderson, Tadayoshi Kohno, and Arvind Krishnamurthy. 2016.  Satellite: Joint Analysis of CDNs and Network-Level Interference. USENIX Association.
  * Singh et al. (2020) Kushagra Singh, Gurshabad Grover, and Varun Bansal. 2020\.  How India censors the web. In _Proceedings of the 12th ACM Conference on Web Science_. 21–28.
  * Sundara Raman et al. (2020) Ram Sundara Raman, Prerana Shenoy, Katharina Kohls, and Roya Ensafi. 2020.  Censored Planet: An Internet-wide, Longitudinal Censorship Observatory. In _Proceedings of the 2020 ACM SIGSAC CCS_.
  * transmission control (1981) transmission control 1981.  Transmission Control Protocol.  RFC 793.  https://doi.org/10.17487/rfc793
  * VanderSloot et al. (2018) Benjamin VanderSloot, Allison McDonald, Will Scott, J. Alex Halderman, and Roya Ensafi. 2018\.  Quack: Scalable Remote Measurement of Application-Layer Censorship. In _27th USENIX Security Symposium (USENIX Security 18)_.
  * Vermeulen et al. (2020) Kevin Vermeulen, Justin P Rohrer, Robert Beverly, Olivier Fourmaux, and Timur Friedman. 2020\.  Diamond-Miner: Comprehensive Discovery of the Internet’s Topology Diamonds. In _17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20)_. 479–493.
  * VMWARE (2020) VMWARE. 2020\.  Understanding IP Hash load balancing (2006129).  .
  * Wang et al. (2017) Zhongjie Wang, Yue Cao, Zhiyun Qian, Chengyu Song, and Srikanth V Krishnamurthy. 2017.  Your state is not mine: a closer look at evading stateful internet censorship. In _Proceedings of the 2017 Internet Measurement Conference_. 114–127.
  * Weaver et al. (2009) Nicholas Weaver, Robin Sommer, and Vern Paxson. 2009\.  Detecting Forged TCP Reset Packets.. In _NDSS_.
  * Weinberg et al. (2021) Zachary Weinberg, Diogo Barradas, and Nicolas Christin. 2021\.  Chinese Wall or Swiss Cheese? Keyword filtering in the Great Firewall of China. In _Proceedings of the Web Conference 2021_.
  * Westphal (2016) Florian Westphal. 2016\.  bridge filtering with nftables.  (2016).
  * Winter and Lindskog (2012) Philipp Winter and Stefan Lindskog. 2012.  How the Great Firewall of China is Blocking Tor. In _USENIX FOCI_.
  * Wright (2014) Joss Wright. 2014\.  Regional variation in Chinese internet filtering.  _Information, Communication & Society_ (2014).
  * Xu et al. (2011) Xueyang Xu, Z. Morley Mao, and J. Alex Halderman. 2011\.  Internet Censorship in China: Where Does the Filtering Occur?. In _Workshop on Passive and Active Network Measurement (PAM)_.  http://www.eecs.umich.edu/~zmao/Papers/china-censorship-pam11.pdf
  * Yadav et al. (2018) Tarun Kumar Yadav, Akshat Sinha, Devashish Gosain, Piyush Kumar Sharma, and Sambuddho Chakravarty. 2018\.  Where The Light Gets In: Analyzing Web Censorship Mechanisms in India. In _Proceedings of the Internet Measurement Conference 2018_ (Boston, MA, USA) _(IMC ’18)_. Association for Computing Machinery, New York, NY, USA, 252–264.  https://doi.org/10.1145/3278532.3278555
  * Zuckerman (2008) Ethan Zuckerman. 2008\.  How a Pakistani ISP briefly shut down YouTube.  https://ethanzuckerman.com/2008/02/25/how-a-pakistani-isp-briefly-shut-down-youtube/
  * Zuckerman (2010) Ethan Zuckerman. 2010\.  Intermediary Censorship.  In _Access Controlled - The Shaping of Power, Rights, and Rule in Cyberspace_. MIT Press, 71–86.

##  Appendix A Routing Path Variation

Figure 8. _Normalized Distribution of Number Of Nodes across all
destinations_. As with _Number of paths_ , observe that there are two modes of
note: 1) varying source IPs has a greater impact than varying source port, and
2) Varying source IP and port have a comparable impact. We also note that for
some countries (Iran), we see differences in the observed behavior among
different protocols.

Figures 8 shows normalized distribution of _Number of Nodes_ (contrast to
Figure 2 which showed the normalized distribution for _Number of Paths_). We
observe that pattern of variations between protocols, for the same country
remain quite similar and variation in source port and IP produce various
modes.

##  Appendix B Overlap in Destinations Affected by ECMP Routing Across
Protocols

Figure 9.  Venn diagram showing the overlap in destinations with censorship
variation per protocol, by country. We find overlap across protocols varies
significantly by country.

We explore the overlap in the destinations (and ASes) impacted across various
protocols on a per-country basis. i.e., do all destinations experience
variation equally across protocol, or does measurement of some protocols vary
with route more than others?

Figure 9 shows with Venn diagrams for overlap between protocols for all
countries where we observed censorship variation. This overlap between
protocols varies for each country with IN having the highest overlap at 88% to
KR with no overlap. We note that in the case of RW even though there is a 100%
overlap in ASes that are impacted, there is only 35% overlap in destinations
that are impacted, potentially pointing to different protocols being impacted
by ECMP routing differently.

##  Appendix C RQ4 (cont’d): What are the underlying network structures that
cause changes in censorship?

Section 5.4 explored the different underlying effects causing ECMP induced
differences in censorship results. In this section we present Figure 10, which
provides more network graphs that showcase these effects in the other
countries.

Figures continue on next page.

(a)

(b)

(c)

(d)

(e)

(f)

Figure 10.  Network graphs, extension of Figure 5 that demonstrates the
effects described in Section 5.4 for more countries.