Russia's TSPU platform, produced by RDP.ru, combines the EcoSGE hardware-software base with EcoFilter and EcoDPI modules to inspect and control internet traffic at scale.
The system distinguishes between "dumb" blocking by IP address, port or transport protocol and "smart" blocking that relies on deep packet inspection signatures.
EcoFilter evaluates five-tuple connection data and applies blacklist rules, while EcoDPI reassembles TCP segments, parses TLS ClientHello messages, extracts SNI values and compares traffic patterns against protocol fingerprints.
DNS queries are an early interception point: operators can return NXDOMAIN, REFUSED, SERVFAIL or redirect responses, or simply drop packets on UDP port 53.
Users therefore turn to DoH and DoT, although these encrypted channels themselves carry detectable fingerprints that can be blocked.
Once an IP address is obtained, the connection passes through bypass balancers and then the main EcoFilter devices that may silently drop packets, inject TCP RST segments or throttle throughput after an initial data window.
ECH protects the inner ClientHello, yet the mere presence of the ECH extension can itself become a blocking criterion.
Popular circumvention protocols include SSH, Hysteria 2, NaiveProxy, Mieru, Juicity, Shadowsocks and VLESS, each offering different trade-offs between obfuscation and performance.
Recommended clients on mobile devices are Exclave, FlClash, Happ, Incy, Hiddify and Karing; desktop users commonly choose Throne, v2rayN and Hiddify.
Future enhancements mentioned in the article include mandatory residential whitelists, broader traffic interception capabilities and the deployment of neural-network classifiers for protocol identification.
