What “GFW” means in practice

GFW usually refers to the “Great Firewall of China,” a set of technical measures that restricts access to certain online content and services in mainland China. In plain terms: when traffic matches patterns the system flags, connections may be slowed, redirected, or prevented from completing.

People sometimes describe GFW as if it is one single device, but it’s better thought of as multiple controls working together across name resolution (how domain names become IP addresses) and the network traffic that follows.

Because the exact implementation can change and is not fully public, you should treat “GFW will do X” statements as general expectations, not reliable guarantees.

How it typically works (mechanisms at a high level)

Most censorship systems rely on a mix of these capabilities:

  1. Name and address controls
  • DNS tampering or filtering: If a domain is blocked or redirected at the name-resolution step, your connection may never reach the intended server.
  • IP-based blocking: Some destinations may be unreachable, even if the domain name is not handled as you expect.
  1. Traffic inspection and rule matching
  • Deep packet inspection (DPI): The system can examine packet contents and metadata to decide whether traffic resembles prohibited categories or known patterns.
  • Protocol and endpoint identification: It can use information visible on the wire (for example, handshake metadata or recognizable flows) to apply rules.
  1. Active interference during connection setup and transfer Once a connection is detected as matching a rule, the system may:
  • prevent the handshake from completing,
  • inject resets/blocks,
  • throttle by limiting throughput,
  • or apply inconsistent treatment depending on timing and path.

Key limitations and why symptoms can be misleading

A major limitation is that censorship behavior is not always uniform:

  • Inconsistency: The same domain or service may behave differently depending on network path, time of day, or routing changes.
  • Scope differences: Blocks can target certain domains, certain IP ranges, or specific protocols, so “it works sometimes” can still be consistent with filtering.
  • False attribution: Poor connectivity, overloaded networks, NAT issues, ISP routing changes, or local firewalls can produce symptoms that look similar to censorship.
  • Measurement limits: You can observe outcomes, but you usually cannot prove exactly which component intervened.

This uncertainty matters when you perform “is it GFW?” checks. The goal is not perfect attribution; it’s reasonable classification.

Practical checks you can run to distinguish filtering from general network problems

Here are non-technical and moderately technical checks that can help you interpret what’s happening—without needing to assume a specific brand, tool, or configuration.

  1. Compare DNS resolution vs. connection success
  • Test whether a blocked-looking domain resolves to the expected IPs.
  • If name resolution fails or returns unexpected results while other domains work normally, filtering at the name layer becomes more plausible.
  1. Observe where the failure happens in HTTPS/TLS handshakes
  • If failures occur consistently during connection establishment (before or during handshake), that points toward active blocking.
  • If you can establish a connection but get timeouts or slow downloads, throttling or path issues may be involved.
  1. Try the same destination via different network paths
  • Switch between mobile data and Wi‑Fi, or between different ISPs if available.
  • If behavior changes drastically, routing- or path-dependent enforcement may be at play.
  1. Compare multiple sites within the same category
  • If one specific site fails but others with similar content types load normally, the issue may be more selective than a broad outage.
  1. Look for consistent patterns across attempts
  • Repeated, similar outcomes (same stage of failure, similar error types) are more indicative of deliberate interference than random packet loss.

Important: none of these checks alone proves “GFW did it.” But together they help you narrow down likely causes.

When people discuss GFW, they often mean a combination of concepts:

  • Censorship-by-blocking: outright prevention of access to certain destinations.
  • Throttling: intentionally reduced throughput that may still allow connections to start.
  • Traffic inspection (DPI): examining packet data/metadata to classify traffic.
  • Name resolution control: altering or filtering how domains map to IP addresses.
  • Protocol-specific filtering: rules that apply to particular protocols or handshake features.

Also note that other local or regional restrictions can look similar. The best approach is to interpret observed behavior as “consistent with censorship controls” rather than treating it as a certain diagnosis.