TLS MITM and Throttling to 10 Mbps: Two Distinct Network Degradation Patterns Observed in Russia

Russian users connecting through Tunnel Cat have encountered sudden slowdowns and instability on international links. Examination of logs and user reports identified two distinct mechanisms that produce overlapping symptoms yet differ fundamentally in cause and detection.

International traffic throttled after initial success

The first pattern shows connections that establish normally with TCP and TLS completing successfully. Data transfer begins at expected speeds before throughput collapses, sometimes within seconds and sometimes after several minutes, occasionally falling from roughly 80 Mbps to 8–12 Mbps. This behavior differs from outright blocking, where routes either function or fail completely. Russian operators appear to be applying graduated throttling to international traffic rather than cutting it off entirely. Two hypotheses have been proposed: deep packet inspection that initially permits a flow and later subjects it to heavier analysis, or a gradual regulatory tightening of permitted bandwidth. Both remain unconfirmed, but the observable effect is consistent degradation that begins only after the connection is already active.

TLS certificate substitution detected on Windows

The second pattern produces similar user-visible instability yet includes a clear additional indicator: affected Windows machines receive an unexpected TLS certificate. Tunnel Cat logs from dozens of Windows systems showed clients obtaining a substitute certificate instead of the legitimate server certificate. This constitutes classic man-in-the-middle interception in which an intermediary terminates the client TLS session, decrypts the traffic, and forwards it onward under its own credentials. The same connection type often functioned normally on other operating systems, pointing to a platform-specific interception mechanism.

When Tunnel Cat detects an incorrect certificate it immediately drops the session. To the end user the result appears as intermittent connectivity, slow page loads, and frequent tunnel drops—the same complaints that arise from simple route degradation. Distinguishing the two therefore requires inspection of certificate chains in addition to RTT and packet-loss metrics.

Practical diagnostic guidance

Operators and users troubleshooting similar issues should separate the scenarios: connections that start normally and then degrade point toward bandwidth throttling or DPI effects, while TLS errors that appear predominantly on Windows warrant immediate certificate validation. Tunnel Cat has released updates that mitigate some symptoms, yet the underlying network changes continue. The distinction matters because one scenario reflects capacity management while the other represents active interception of encrypted sessions.