Choosing a Transport Family: Vulnerability Profiles, Not a Ranking

Transports cannot be ranked by strength — their vulnerability profiles differ in kind, not in degree. Four families across five axes, and the rule of diverse failure modes.

2026-08-31 GIGATAP Team #vpn
#vpn#anticensorship#reality#hysteria#shadowsocks#architecture

Choosing a Transport Family: Vulnerability Profiles, Not a Ranking

“Which transport is best” gets asked constantly and has no answer in that form. Not because they are all alike, but because they are vulnerable to different things. Transports differ not in strength but in what exactly they are vulnerable to, so a meaningful choice is not a winner but a set with non-overlapping failure modes.

Here are the axes along which they actually differ.

Five axes, not one scale#

A transport’s resilience is not a number. It is a set of properties, and a transport strong on one axis is usually weak on another.

Axis The question it answers
Content are there constant bytes by which the protocol is recognised
Traffic shape do sizes, directions and pauses give it away
State does it exploit differences between protocol implementations
Probing what does a stranger knocking on the port receive
Metadata what is visible about the address, the name, and name resolution

A transport with a perfect score on the first axis can fail on the second — and that is the typical case rather than an exception.

Four families#

TLS camouflage. Outwardly the connection looks like an ordinary secure connection to a plausible site. An unauthorised request is handled the way a real web server would handle it.

Strong against signatures and against probing. Weak against handshake-fingerprint analysis and traffic shape: a plausible handshake does not change the fact that a nested secure connection is visible afterwards.

Random stream. The goal is the absence of recognisable structure. No headers, no fixed fields.

Strong against content matching and, when implemented properly, against probing. Weak against the “unknown and high-entropy is suspicious” model covered separately.

UDP families. Speed and low overhead; some solutions can change port on the fly.

One caveat that tends to be learned late: UDP does not exempt you from the volume restriction. An update to the mechanism’s description states explicitly that the limit applies to TCP and UDP alike. On top of that, QUIC is parsed by observers — the name is extracted from the initial packet.

Web mimicry. The transport does not imitate a permitted protocol; it is one: a real web server stands behind it, and part of the traffic is genuine web traffic.

The most expensive to deploy: it needs a domain, a certificate, a working site. In exchange it delivers what the others cannot — cost of error for the blocker.

Summary: where each family is weak#

                 content   shape   state   probing   metadata
TLS camouflage      ✓✓       ~       ~       ✓✓         ~
Random stream       ✓✓       ~       ~        ✓         ~
UDP families        ✓✓       ~       ✓        ~         ~
Web mimicry         ✓✓      ✓✓       ~       ✓✓         ~

✓✓ strong   ✓ moderate   ~ depends on implementation and conditions

Note the metadata column: it is identical for all of them. No transport hides the destination address. Address reputation is a property of placement, not of protocol, and no amount of camouflage changes it.

A comparison error: different profiles, not different strength#

An instructive case is retiring two transports in a single decision.

Transport Against signatures Against “unknown high-entropy” Against probing
Random stream strong weak — that is the class itself moderate
TLS camouflage strong not applicable — it is real TLS strong with a good fallback

The profiles are opposite. The first is vulnerable exactly where the second is invulnerable by construction.

Hence a rule worth applying when revisiting a transport portfolio: when retiring a transport, name what it protected against. Otherwise it is easy to remove the only thing covering a specific vector and not notice — until the vector fires.

Why should you not pick just one?#

From all of the above follows a criterion more important than choosing “the best”. If two transports are vulnerable to the same thing, the second is not a reserve but a copy.

If two transports are vulnerable to the same thing, the second is not a reserve — it is a copy. The mechanism that defeats the first defeats the second, and switching does not help.

BAD SET
transport A ─┐
             ├── both vulnerable to traffic-shape analysis
transport B ─┘    one mechanism covers both

GOOD SET
transport A ── vulnerable to shape analysis
transport B ── vulnerable to entropy classification
                the mechanisms are independent, switching means something

Stated as a criterion: diversity of failure modes matters more than combined strength. Two different transports are more resilient than two good ones of the same kind.

What choosing a transport does not solve#

Worth naming explicitly, so effort is not spent in the wrong place.

Address reputation. A known address is blocked regardless of what runs on it.

Network position. Which rules apply where is a property of placement, not of protocol.

Settings delivery. A transport is useless if the configuration cannot be updated.

Client behaviour. A bulk fan-out of probes provokes restriction under any transport.

Conclusion#

There is no transport ranking, because there is more than one axis. There are vulnerability profiles, and they differ in kind rather than in degree.

Two practical consequences. First: choose a set, not a winner, and choose it so the failure modes do not coincide. Second: when retiring a transport, name what it protected against — otherwise simplifying the portfolio quietly removes protection nobody intended to remove.

Terms#

  • Vulnerability profile - the set of axes on which a transport is weak or strong, instead of a single strength rating.
  • Failure mode - the specific mechanism that stops a transport from working.
  • Failure-mode diversity - the property of a transport set where no single mechanism disables several at once.

FAQ#

Which transport is the most resilient?#

The question has no answer in that form: there are several axes, and a transport strong on one is usually weak on another.

Why keep more than one transport?#

So the mechanism that defeats one does not defeat the rest. Two transports of the same kind provide no reserve.

What to consider when retiring a transport?#

Name what it protected against. Otherwise simplifying the set quietly removes protection nobody intended to remove.

Further reading#