HTTPS packet chunking工作原理深度技术问询（含绕过ISP DPI应用场景）

Hey there, let’s dive deep into how HTTPS packet chunking works—specifically how it helps you bypass ISP DPI, since you’re using PowerTunnel and curious about the technical nuts and bolts.

First, let’s set the stage: ISP DPI systems rely on identifying full, structured traffic patterns to block or throttle content. For HTTPS, this usually means scanning things like:

• The complete TLS Client Hello packet (looking for SNI fields that match blocked domains, specific cipher suite lists, or standard handshake sizes)
• Full HTTP request headers (like Host, User-Agent, or URL paths) that fit their blocked content rules

Packet chunking breaks this pattern by intentionally splitting what would be a single, large TCP packet into much smaller fragments before sending them over the network. Here’s the breakdown of how it works technically, and why it beats DPI:

1. TCP Layer: Forced, Controlled Fragmentation #

Normally, TCP uses the Maximum Segment Size (MSS) of your network link to package application data into optimal-sized packets. But tools like PowerTunnel skip this automated process and manually split data into tiny, disjointed fragments—often way smaller than the MSS.

For example, a full TLS Client Hello (which might be 500-1000 bytes) could be split into 3-4 separate packets of 100-200 bytes each. The key here is that this is active, intentional splitting (not passive fragmentation caused by network hops).

Most basic DPI tools aren’t built to reassemble these tiny fragments into a full packet before making a blocking decision. They either scan fragments in real time (missing the full pattern) or can’t hold onto fragments long enough to reassemble them without causing network delays (which would break user experience).

2. Application Layer: Chunking HTTP Requests (Beyond Standard Chunked Encoding) #

For HTTP/1.1 traffic, the standard already supports Transfer-Encoding: chunked for sending request/response bodies in pieces. But DPI-bypassing tools take this a step further:

• They split HTTP headers (which are supposed to be sent as a single block) into multiple TCP fragments. So a single Host: blocked-domain.com header might be split into two packets: one with Host: bl and another with ocked-domain.com.
• They also randomize the size of each chunk and add small, variable delays between sending fragments. This throws off DPI systems that rely on timing or consistent chunk sizes to identify traffic.

3. Why This Bypasses DPI #

The core trick boils down to two weaknesses in most ISP DPI setups:

• Performance vs. Accuracy: DPI tools need to process traffic quickly to avoid slowing down the network. Reassembling hundreds of tiny fragments for every connection would eat up too much CPU and memory, so many tools just scan fragments as they come through—missing the full context needed to trigger a block.
• Rule Matching Limitations: Most DPI block rules are written to match full, complete strings or packet structures. If a blocked SNI or URL is split across multiple fragments, the tool’s rule engine can’t find a full match, so it lets the traffic pass.

Of course, advanced DPI systems can reassemble fragments and scan the full packet—but they’re more expensive, and many ISPs don’t deploy them everywhere. Packet chunking is still one of the simplest, most effective ways to get around basic to mid-tier DPI.

备注：内容来源于stack exchange，提问作者Pixie