On Mon, 14 Mar 2022 at 13:17, Stephane Bortzmeyer <bortzme...@nic.fr> wrote: > > On Mon, Mar 14, 2022 at 10:26:46PM +1100, > Jen Linkova <furr...@gmail.com> wrote > a message of 37 lines which said: > > > It is. Facebook is officially blocked in Russia [1] > > > > [1] https://rkn.gov.ru/news/rsoc/news74156.htm > > I know but I was asking *how* it is implemented and it is far from > obvious, from the data. Hence my question to network experts: how to > explain what the Atlas probes see?
Most likely TCP session kill based on the server response (certificate). It could also be a combination of multiple indicators. IP addresses, SNI, TTL, but here it seems more likely to be the first one. This could be proven: put a self-signed cert of www.facebook.com on a server and try to repeat the IP address based check. Lukas -- ripe-atlas mailing list ripe-atlas@ripe.net https://lists.ripe.net/mailman/listinfo/ripe-atlas
