Trojan-Go

In the early days, the firewall only intercepted and reviewed outbound traffic, that is,Passive detection. Shadowsoks' encryption protocol design makes the transmitted data package itself have almost no characteristics, and it looks similar to a completely random bitflow, which can indeed effectively bypass GFW in the early days. Contrary to Shadowsoks, Trojan does not use self-defined encryption protocols to hide itself. On the contrary, the clearly characterized TLS protocol (TLS/SSL) is used to make the flow look the same as the normal HTTPS website. TLS is a mature encryption system, and HTTPS uses TLS to carry HTTP traffic. For passive testing, the flow of the Trojan agreement is completely consistent with the characteristics and behavior of the HTTPS flow. HTTPS traffic accounts for more than half of current Internet traffic, and the traffic is confidential after TLS's handshake is successful. There is almost no feasible way to distinguish Trojan protocol traffic from it.