当GFW看到自客户端发送的第一个SYN包以启动TCP三次握手时，其开始跟踪该TCP连接的状态。HTTP、SMTP、HTTPS等许多应用协议都基于TCP。GFW在该TCP控制块（TCP control block）内进行上文所述之检测[25][66]，遇到预期关键字后，其会注入带有一个RST选项的“一型”[已过时]和多个带有RST/ACK选项的“二型”数据包，这被认为是来自两种同时部署的审查设备。一型IPID为0，具有随机的窗口尺寸（英语：TCP tuning#Window_size），没有设置“不分片”选项；二型则有周期性增加的TTL值和窗口尺寸，并且设置了“不分片”[67][25]。
思科系统和一些其他西方通信设备供应商向中华人民共和国政府提供了具有流量监控和过滤功能的互联网设备，用来封堵网站和追踪网上一些活跃的持不同政见者[115][116]。2006年2月，美国国会为此召开听证会，向思科、微软、雅虎、Google四家公司提出质询[117]。美国中国信息中心（China Information Center）的吳弘達指责，思科不断主动地与中国中央及各省国家安全部门联系，向其提供最新技术，包括警车间的即时通讯和指挥系统、以及声音识别技术和指纹鉴别技术[117]。记者Sarah Lai Stirland在Wired News发表了一篇文章，并公布了一份泄漏的思科机密幻灯片文档。该文档详细描述了思科和中国政府在金盾工程上具有商业性质的合作[118]。她还在文章中指责，思科在市场营销中将这些技术明确划分为“镇压工具（A Tool of Repression）”。思科的辩护者声称，实际上，在中国大陆现行的内容过滤系统中，路由器只是作为底层执行设备对人为指定的目的地址进行屏蔽，这是任何一台商用路由器都必须提供的基本功能，思科并没有向中国政府提供特别开发和定制的互联网设备[119][32]。
Geremie R. Barme; Ye, Sang. The Great Firewall of China. Wired. 1997-06-01 [2015-12-29]. （原始内容存档于2016-01-01）. A computer engineer in his late 30s, Comrade X...is overseeing efforts to build a digital equivalent to China's Great Wall. Under construction since last year, what's officially known as the "firewall" is designed to keep Chinese cyberspace free of pollutants of all sorts
Kazuho, Oku,; Christopher, Wood,; Eric, Rescorla,; Nick, Sullivan,. Encrypted Server Name Indication for TLS 1.3. IETF. 2018-07-02 [2021-10-07]. （原始内容存档于2018-08-13） （英语）. Although TLS 1.3 [I-D.ietf-tls-tls13] encrypts most of the handshake, including the server certificate, there are several other channels that allow an on-path attacker to determine the domain name the client is trying to connect to, including:… Cleartext Server Name Indication (SNI) [RFC6066] in ClientHello messages.
Roya Ensafi; Philipp Winter; Abdullah Mueen; Jedidiah R. Crandall. Large-scale Spatiotemporal Characterization of Inconsistencies in the World's Largest Firewall. 2014-10-03. arXiv:1410.0735.
Kevin Bock; Gabriel Naval; Kyle Reese; Dave Levin. Even Censors Have a Backup: Examining China's Double HTTPS Censorship Middleboxe. Proceedings of the ACM SIGCOMM 2021 Workshop on Free and Open Communications on the Internet. Association for Computing Machinery: 1-7. 2021. ISBN 9781450386401. doi:10.1145/3473604.3474559.
Philipp Winter; Stefan Lindskog. How the Great Firewall of China is Blocking Tor. 2nd USENIX Workshop on Free and Open Communications on the Internet (FOCI 12). USENIX Association. 2012-08 [2024-01-14]. （原始内容存档于2024-01-14）.
Rescorla, Eric. The Transport Layer Security (TLS) Protocol Version 1.3. tools.ietf.org. 2018-08 [2021-10-08]. （原始内容存档于2019-06-03） （英语）. All handshake messages after the ServerHello are now encrypted. The newly introduced EncryptedExtensions message allows various extensions previously sent in the clear in the ServerHello to also enjoy confidentiality protection.
Anonymous; Arian Akhavan Niaki; Nguyen Phong Hoang; Phillipa Gill; Amir Houmansadr. Triplet Censors: Demystifying Great Firewall’s DNS Cnsorship Behavior. 10th USENIX Workshop on Free and Open Communications on the Internet (FOCI 20). USENIX Association. 2020-08 [2024-01-11]. （原始内容存档于2024-01-11）.
Anonymous. The Collateral Damage of Internet Censorship by DNS Injection. SIGCOMM Comput. Commun. Rev. (Association for Computing Machinery). 2012-06-26, 43 (3): 21–27. ISSN 0146-4833. doi:10.1145/2317307.2317311.
Steven Mufson; Jia Lynn Yang. China accuses hackers of Internet disruption; experts suspect error by government censors. 华盛顿邮报. 2014-01-22. （原始内容存档于2016-04-01）. “The rule was supposed to be, ‘Block everything going to this IP address,’” said Nicholas Weaver, a researcher at the International Computer Science Institute, which is affiliated with the University of California at Berkeley. “Instead, they screwed up and probably wrote the rule as ‘Block everything by referring to this IP address.’”
Mingshi Wu; Jackson Sippe; Danesh Sivakumar; Jack Burg; Peter Anderson; Xiaokang Wang; Kevin Bock; Amir Houmansadr; Dave Levin; Eric Wustrow. 中国的防火长城是如何检测和封锁完全加密流量的. USENIX Security Symposium 2023. 2023-04-28 [2023-04-28]. （原始内容存档于2023-04-28）.
Anderson, Daniel. Splinternet Behind the Great Firewall of China: Once China Opened Its Door to the World, It Could Not Close It Again.. Queue (Association for Computing Machinery). 2012-11, 10 (11): 40–49. ISSN 1542-7730. doi:10.1145/2390756.2405036. According to a paper published by its designers, GFW relies on null routing (see figure 1) to block IP packets by blacklisting destination addresses. By peering with the gateway routers of all Chinese ISPs, GFW injects routing information into BGP (Border Gateway Protocol) and hijacks all traffic to blocked websites—such as twitter.com.
Cao Siqi. Foreign VPN service unavailable in China. Global Times. 2015-01-23 [2021-10-07]. （原始内容存档于2022-06-22）. Astrill claimed in a Wednesday notice that since this year, VPN protocols used on iOS devices, including IPSec, L2TP/IPSec and PPTP, are not accessible in China in almost real-time.
Tim Wilde. Knock Knock Knockin' on Bridges' Doors. Team Cymru, Inc. Tor Blog. 2012-01-07 [2012-01-10]. （原始内容存档于2012-01-13）. First, "garbage binary" probes, containing nothing more than arbitrary (but sometimes repeated in later probes) binary data, were experienced by the non-China side of any connection that originated from China to TCP port 443 (HTTPS) in which an SSL negotiation was performed. This probe was performed in near-real-time after the connection was established, … The second type of probe, on the other hand, is aimed quite directly at Tor. When a Tor client within China connected to a US-based bridge relay, we consistently found that at the next round 15 minute interval (HH:00, HH:15, HH:30, HH:45), the bridge relay would receive a probe from hosts within China that not only established a TCP connection, but performed an SSL negotiation, an SSL renegotiation, and then spoke the Tor protocol sufficiently to build a one-hop circuit and send a BEGIN_DIR cell.
Theories abound for overseas web access troubles. Global Times. 2011-05-18 [2011-05-19]. （原始内容存档于2011-05-21）. Fang Binxing, president of Beijing University of Posts and Telecommunications, attributed the interruptions to Internet service providers' economic concerns. "Service providers have to pay the bill of the international Internet flow for their users. So there is incentive for the companies to discourage users to visit foreign websites," he said. … An anonymous official with the Ministry of Industry and Information Technology declined to explain why foreign websites were frequently inaccessible a telephone interview with the Global Times, and instead urged users to "check their own technology problems and with the websites' servers on the first place."
Microsoft Says Outlook Hacked in China. 華爾街日報. 2015-01-21 [2021-10-09]. （原始内容存档于2021-10-09） （英语）. Outlook users in China accessing their email through an email client saw a pop-up message saying “Cannot Verify Server Identity” and asking if they wanted to continue anyway
JR, Crandall; Zinn D; Byrd M; Barr E; East R. ConceptDoppler: A Weather Tracker for Internet Censorship(PDF). Proceedings of the 14th ACM Conference on Computer and Communications Security. Association for Computing Machinery: 352–365. 2007-10-28 [2007-09-13]. ISBN 9781595937032. doi:10.1145/1315245.1315290. （原始内容存档(PDF)于2007-10-26） （英语）. Inspired by initial work on the Great Firewall of China (GFC)’s keyword filtering mechanism, we sought a better understanding of its implementation and found it to be not a firewall at all, but rather a panopticon where the presence of censorship, even if easy to evade, promotes self-censorship.
