Bleedthrough — the GFW injector fleet
Not what the Great Firewall blocks, but what the censor is —
the size, the forged-IP pools, and the regional structure of its DNS-injector fleet, reconstructed
from outside China by making the injectors answer benign probes. The censor is the sensor.
◆ DEMO READING — illustrative output of the real pipeline over canned inputs,
shown while a live prober is stood up. Not a live measurement. The first real round replaces it.
How this reads the machine, not the policy
- A benign, stateless UDP DNS query for a censored domain is sent toward China. The on-path
GFW is bidirectional, so its own injector answers with a forgery — no node inside China needed.
- Fleet size comes from how many parallel injectors answer one query, and from the order they
cycle their forged-IP pool (the Wallbleed model).
- Regional divergence — a province whose forged-IP pool disagrees with the national baseline is
a candidate autonomous provincial firewall (the "wall behind a wall").
- An open-resolver fallback rides Chinese resolvers' outbound recursion, so the signal survives
the decay of the inbound-injection channel.