QQ屏蔽手段及大智慧.doc

QQ屏蔽分析QQ登录过程（腾讯QQ2008贺岁版）l 使用UDP连接sz(x).:8000l 使用TCP连接tcpconn(x).:80l 使用TCP连接tcpconn(x).:443l 尝试连接以往曾经登录过的服务器： 连接TCP服务器失败【3:443(4294967295)】 连接TCP服务器失败【5:443(4294967295)】 连接TCP服务器失败【46:443(4294967295)】QQ屏蔽规则（方法一，比较复杂）首先屏蔽、，然后屏蔽已知的QQ服务器IP地址。具体的规则如下： user xxxx condition=QQ_proxy force_deny user xxxx condition=QQ_socks force_deny ALLOW http.method=CONNECT ALLOW socks.method=CONNECTdefine condition QQ_serverurl.domain=//url.domain=//url.address=46url.address=3url.address=00/32url.address=03/32url.address=07/32url.address=23/32url.address=24/32url.address=27/32url.address=45/32url.address=46/32url.address=50/32url.address=56/32url.address=35/32url.address=5url.address=/32url.address=2/32url.address=8/32url.address=19/32url.address=63/32url.address=64/32url.address=66/32url.address=33/32url.address=51/32url.address=52/32url.address=53/32url.address=54/32url.address=26/32url.address=52/32url.address=3/32url.address=2/32url.address=6/32url.address=03/32url.address=53/32url.address=65/32url.address=71/32url.address=09/32url.address=21/32url.address=33/32url.address=5/32url.address=9/32url.address=0/32url.address=1/32url.address=13/32url.address=14/32url.address=15/32url.address=16/32url.address=5/32url.address=71url.address=73end QQ_serverdefine condition QQ_proxy http.method=CONNECT condition=QQ_server condition=worktimeend QQ_proxydefine condition QQ_socks socks.method=CONNECT condition=QQ_server condition=worktimeend QQ_socksdefine condition worktime time=1430.1630 time=0900.1130 endQQ简化屏蔽规则（方法二）QQ使用Connect通过代理设备，但实际上并不使用HTTPS，因此可以使用Detect Protocol来屏蔽它，与屏蔽skype的TB中的方法类似。步骤一、配置如下规则：;-start here-condition=QQ_servers force_denyserver.certificate.validate(no)define condition QQ_servers url.domain=// url.domain=//end;-end here-以上策略中屏蔽、的规则是必须的，否则QQ仍然可以登录。server.certificate.validate(no)的规则可有可无。步骤二、Enable Protocol DetectionSG5:Go to Services - Proxy ServicesSelect HTTP, click EditEnable the detect protocol checkboxSG4:Go to Services - HTTP ProxyClick the Policies TabUncheck Verify server certificate for secure connectionsGo to Services - SSL ProxyCheck Enable SSL detection for HTTP CONNECTCheck Enable SSL detection for SOCKSIf you are transparently redirecting other ports including 443 then select Enable SSL detection for TCP tunnels如果希望对某些用户、组或服务器不使用以上策略，可以在一个新的La