Wait a few ms to filter fake response

[Cuthead]

LAST_RESPONSE is slower because the timeout must be reached. Instead, we can wait for a few ms to start receiving the real response. For China GFW the fake responses always arrive under 45ms.

Golang example: macronut/phantomsocks#96

[FelixLange1998]

Thank you for your input! You are right that the (configurable) timeout must be reached for the LAST_RESPONSE mode. Your suggestion sounds like a good idea for an additional mode that drops all incoming responses for X (configurable) ms and then takes the next received response. There probably should be a fallback though, if no response is received after the configured waiting time.

Where does the 45ms come from? Do you have a reference for us?

[Cuthead]

Where does the 45ms come from? Do you have a reference for us?

No. My own experiment. I lowered the delay value increasingly on that Go program to find a least working one.

[FelixLange1998]

I feel like a static value like this is not going to work very consistently. The concrete time depends on a lot of factors like network conditions, current load, location, etc.

For this new mode, what could work is to dynamically calculate an upper bound like this in a preparation step (+ some offset probably).

[Cuthead]

Yeah, I've just read Hold-On: Protecting Against DNS Packet Injection. Basically you're referring to reimplement the Hold On proxy.