9/24/21, 8:39 PM The State of Internet Censorship in Myanmar | OONI Once the Web Connectivity test has identified the DNS resolver of the user, it then attempts to identify which addresses are mapped to the tested host names by the resolver. It does so by performing a DNS lookup, which asks the resolver to disclose which IP addresses are mapped to the tested host names, as well as which other host names are linked to the tested host names under DNS queries. 3. TCP connect The web connectivity test will then try to connect to the tested websites by attempting to establish a TCP session on port 80 (or port 443 for URLs that begin with HTTPS) for the list of IP addresses that were identified in the previous step (DNS lookup). 4. HTTP GET request As the web connectivity test connects to tested websites (through the previous step), it sends requests through the HTTP protocol to the servers which are hosting those websites. A server normally responds to an HTTP GET request with the content of the webpage that is requested. Comparison of results: Identifying censorship Once the above steps of the web connectivity test are performed both over a control server and over the network of the user, the collected results are then compared with the aim of identifying whether and how tested websites are tampered with. If the compared results do not match, then there is a sign of network interference. Below are the conditions under which the following types of blocking are identified: DNS blocking: If the DNS responses (such as the IP addresses mapped to host names) do not match. TCP/IP blocking: If a TCP session to connect to websites was not established over the network of the user. HTTP blocking: If the HTTP request over the user’s network failed, or the HTTP status codes don’t match, or all of the following apply: 1. The body length of compared websites (over the control server and the network of the user) differs by some percentage; 2. The HTTP headers names do not match; 3. The HTML title tags do not match. It’s important to note, however, that DNS resolvers, such as Google or a local ISP, often provide users with IP addresses that are closest to them geographically. Often this is not done with the intent of network tampering, but merely for the purpose of providing users with localized content or faster access to websites. As a result, some false positives might arise in OONI measurements. Other false positives might occur when tested websites serve different content depending on the country that the user is connecting from, or in the cases when websites return failures even though they are not tampered with. HTTP Invalid Request Line test This test tries to detect the presence of network components (“middle box”) which could be responsible for censorship and/or traffic manipulation. https://ooni.org/post/myanmar-report/ 12/19