tspu-docs: a field manual for the equipment behind Russia's TSPU blocking

What the repository is, and what it is not

tspu-docs is a reference work on TSPU, the technical countermeasures against threats equipment that Russian communications operators deploy. The top level of the repository is small, with a `README.md`, a `docs/` directory, a `chapters/` directory and a `tspu-equipment/` directory, and the primary language of the repository is recorded as unknown, which is a slightly odd classification for a text corpus but consistent with a repository whose content is prose rather than code. There is no build, no package, no test suite and no release process. What there is, is a table of contents of chapters, each in its own Markdown file, covering the system from the operator's access point all the way down to the CLI of an individual filter appliance. The README also links to the author's other projects, a packet processing Linux program for getting around DPI systems and a web interface for managing Xray-core on ASUS routers, which tells you the author's interest is on both sides of the equipment described.

The honest caveat that shapes everything else

The most important line in the README is the note in the table of contents section, which says the documentation was generated with AI from the transcript of a roughly five hour video lecture and was checked by hand, and that it may contain inaccuracies. That single admission is the right lens for the whole repository. The source is a lecture, so the structure is a teaching structure, the terminology follows whoever was speaking, and the level of detail is uneven, with some chapters going deep into specific commands while others are outlines. The manual checking is what makes it usable at all, since a machine transcription of five hours of speech on unfamiliar hardware would otherwise be close to unusable. The practical guidance for a reader is to treat the chapter headings as a map of the subject, which is genuinely useful, and to verify the specific command syntax and hardware details against the real equipment, which is where the risk of error lives.

How the traffic actually flows

The first part of the work lays out the architecture, and it does so from the network rather than from the device. The opening chapters cover the general architecture of the system, the law on the sovereign internet and the participants in the project, what TSPU is as a set of equipment at operators, and the overall scheme with its bypasses, balancers, filters and management segment. The second chapter then follows traffic through the equipment, covering the types of encapsulation at the operator's access point, the split into LAN and WAN ports, the simplest possible configuration with one bypass and one filter, and the typical scheme. A third chapter covers where in the operator's network the equipment sits, listing the positions before the BRAS or BNG, after it and before CGNAT, and after CGNAT closer to the internet exit, and calling out the point after BRAS as the most convenient one. A fourth chapter covers the tiered system, the type B TSPU, which exists to handle traffic that did not pass through the type A equipment, and describes the Eco Highway balancer and its two pipelines.

The bypass and the balancer, as appliances

The second part moves to the hardware. The bypass chapter covers what a bypass is for, the Silicom bypasses used in the federal project, the GL Sun bypasses from the pilot project in the Urals, the monitoring of channels through heartbeat packets, the automatic switch to TAP or active bypass when a channel is lost, and the development of domestic bypass hardware. The balancer chapters are more detailed still, and they read like a vendor manual rather than a lecture summary. The balancer distributes traffic across filters, and the hardware is described as a 32 port, one rack unit device with a throughput of 3.2 Tbit per second, with ports organised in LAN and WAN pairs, flow rules for the filters, traffic balancing, fault tolerance, and handling of encapsulations such as VLAN and MPLS, plus HTTP redirects and TCP resets through the filters. There are separate chapters for the platform, covering a one unit and a two unit variant with 65 ports, port speeds of 10G, 25G and 100G, and the breakout of one QSFP28 into four SFP+ ports at 10G, and for the configuration, covering the operational and configuration modes, the firmware update commands, physical port setup, link setup, balancing groups, a keep alive profile, flow rules, heartbeat settings for the GL Sun equipment and the management interface.

The filter, and a CLI you can actually work with

The filter is where the detail is thickest, and the chapter list reads like a manual index. The principles chapter covers the path of a packet through the filter and the L2 behaviour, where the filter is treated as a transparent wire. The platform chapter covers the lower line of EcoFilter 2020 and 2040, the higher line of EcoFilter 4080, 4120 and 4160, the 2019 models from the Urals pilot and the 2020 models from the federal project, the split of interfaces into even numbered LAN and odd numbered WAN ports, and the platform's history from CGNAT in 2013 to a DPI filter. The session chapter defines a session as a local IP and port, a global IP and port and a remote IP and port, defines a translation, and describes the direction of traffic as egress or ingress. The CLI chapter gives the connection details, console at 115200 8N1 and SSH on port 22, the default login, the distinction between the operational prompt and the configuration prompt, the configuration tree of system, pools and access lists, the commands to apply and save, and several behaviours that only show up in practice, including what happens with two users at once, a trap mode when a bracket is left open, and a keyword for a quick listing.

Monitoring commands and how a filter is set up

Two chapters are the ones an operator would use daily. The monitoring chapter lists the diagnostic commands: hardware information covering CPU, memory, fans, power supplies and temperature, the management interface, firmware versions with their retry counters, port and transceiver state including SFP information, digital diagnostics monitoring and frame statistics, the per flow packet and byte counters for the filtering rules, the state of the balancing group, and a software bypass that can be set per port group. The configuration chapter lists what has to be set on the appliance itself, the console port speed and idle timeout, the management interface with its address, gateway, DNS and allowed addresses, the SSH terminal with auto logout, prompt and line numbering, user creation and removal with access levels and secret 0 or 15 passwords, TACACS+ with a fallback to the local database, NTP with up to three servers, SNMP with a read only community, traps and an allow list, syslog, connection logging through the log interface, and protocol logging to a separate destination. A further chapter covers interface enable and disable, descriptions, the note that LACP is not used, the NAT defaults, session and translation timeouts and IPv6 handling. The last chapter in the visible part deals with the access lists and pools, which is the mechanism for deciding which traffic gets processed.

What this repository is not for

Three limits are obvious. The first is that it is a reference, not a tool, and reading it will not make a system work, only make a system understandable. The second is the accuracy caveat, which is not boilerplate here, because the source is a machine transcription of speech and the subject is hardware with a lot of part numbers and command syntax, which is exactly the kind of content a transcription gets wrong. A wrong port speed or a wrong default password in a document that reads as authoritative is a real operational risk. The third is the licence. The repository records no licence at all, so there is no grant of rights, no warranty and no stated redistribution permission, and while reading and referencing it is unremarkable, vendoring its text into a product or a translation would need the author's answer. The absence of a licence is worth taking seriously, because a documentation project without one is a documentation project whose author may not have thought about reuse.

Editorial conclusion

tspu-docs is worth reading for anyone who wants to understand what the blocking infrastructure actually is, since it documents the hardware, the traffic path, the command line interfaces and the failure modes in one place, and it is honest about being AI generated from a lecture transcript. It is the wrong tool if you are looking for code, because the repository is documentation, and it carries no licence, so treat it as reference material rather than something to redistribute. Before you rely on any of it, check the sections on filter CLI and balancer configuration against your own equipment, since the project itself warns it may contain inaccuracies. The last push was on 2026-09-23, the repository publishes no GitHub releases, and the licence is listed as unknown.

Frequently asked questions

Official sources

1. DanielLavrushin/tspu-docs on GitHub
2. Issues
3. README