[atlas] Facebook in Russia and a diagnostic problem

On Mon, 14 Mar 2022 at 13:17, Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:
>
> On Mon, Mar 14, 2022 at 10:26:46PM +1100,
>  Jen Linkova <furry13 at gmail.com> wrote
>  a message of 37 lines which said:
>
> > It is. Facebook is officially blocked in Russia [1]
> >
> > [1] https://rkn.gov.ru/news/rsoc/news74156.htm
>
> I know but I was asking *how* it is implemented and it is far from
> obvious, from the data. Hence my question to network experts: how to
> explain what the Atlas probes see?

Most likely TCP session kill based on the server response (certificate).

It could also be a combination of multiple indicators. IP addresses,
SNI, TTL, but here it seems more likely to be the first one.

This could be proven: put a self-signed cert of www.facebook.com on a
server and try to repeat the IP address based check.


Lukas