mirror of
https://github.com/amnezia-vpn/amneziawg-go.git
synced 2026-10-15 13:51:57 +00:00
[GH-ISSUE #93] Fill bandwidth with random data on purpose. #48
Labels
No labels
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
amnezia-vpn/amneziawg-go#48
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @hashelq on GitHub (Aug 20, 2025).
Original GitHub issue: https://github.com/amnezia-vpn/amneziawg-go/issues/93
DPI systems today likely already have systems that allow to spam traffic to specific IPs (or duplicate (a)wg packets), to track whether the other end is connected through a DPI system and where the end is located.
An attack would look like this: if the user(who connects through DPI-env) wants to anonymize himself with VPNs that is not accessible by bad actors (is located outside of the country, etc), he would likely set a VPN+VPN setup, so DPI systems would not see the traffic coming and outcoming from the same IP.
But this does not fully guarantee that the DPI will not be able to trace the user.
If there is an connection/forwarded port, the DPI system will spam packets and trace who is receiving this huge amount of packets in the DPI env. Doing this in multiple rounds will result in a fast an efficient lookup that will find the other end IP very fast.
I guess it worth it to implement a mitigation inside the VPN protocol itself, so there will always be a static amount of random data (setup by user, with a limit, like 1MiB/4MiB/8MiB/custom etc) (decay) segmented and sent, the real data will be embedded inside the decay, making such attacks impossible.