censorship

Shadowsocks-libev is an encrypted SOCKS5 proxy. It does not tunnel a whole network stack the way a VPN does. The client exposes a local SOCKS5 port that applications point at, and the server relays each connection to its destination over an encrypted link. The stream carries no recognizable protocol handshake, which is why it appears as random bytes to an observer. The usual topology puts the client behind a censoring network and the server on an overseas VPS.

This post covers the libev implementation on Debian-family systems. The Chinese censor does more than watch traffic passively. It actively probes suspected servers, and a confirmed Shadowsocks server has its IP blocked in mainland China. Cipher choice determines how long a server lasts, not whether it is invulnerable.