What is iat-mode at the end of obfs4's bridge lines?

Question

By looking at a obfs4 bridge, we can see that it ends with iat-mode=x which x can be 0, 1 or 2.

Bridge obfs4 1.2.3.4:9443 0F2C3218 cert=FH+9dukjekdfhcn iat-mode=0

What does this iat-mode indicates about a bridge?

Answer 1

Based upon the code that Andrei posted, it seems that 0 means IAT obfuscation is off, 1 means it is enabled, and 2 is paranoid.

A random paper I found says IAT stands for "Inter-Arrival Time", another random website I found says IAT is "The amount of time that elapses after the receipt of a packet until the next packet arrives"

---

Of course, all of that still doesn't say much, so I asked #tor-dev(elopers). Arma confirmed it was Inter-arrival Time and said:

it slightly rearranges the timing between groups of bytes it sends, in hopes of messing up timing signatures based on the underlying protocol that obfs4 is obfuscating.
it might do something. it might not. more research is required, to make one that we can say something more specific about

Answer 2

see https://github.com/Yawning/obfs4/blob/obfs4proxy-0.0.9/transports/obfs4/obfs4.go#L521

if conn.iatMode != iatNone {
    var iatFrame [framing.MaximumSegmentLength]byte
    for frameBuf.Len() > 0 {
        iatWrLen := 0

        switch conn.iatMode {
        case iatEnabled:
            // Standard (ScrambleSuit-style) IAT obfuscation optimizes for
            // bulk transport and will write ~MTU sized frames when
            // possible.
            iatWrLen, err = frameBuf.Read(iatFrame[:])

        case iatParanoid:
            // Paranoid IAT obfuscation throws performance out of the
            // window and will sample the length distribution every time a
            // write is scheduled.
            targetLen := conn.lenDist.Sample()
            if frameBuf.Len() < targetLen {
                // There's not enough data buffered for the target write,
                // so padding must be inserted.
                if err = conn.padBurst(&frameBuf, targetLen); err != nil {
                    return 0, err
                }
                if frameBuf.Len() != targetLen {
                    // Ugh, padding came out to a value that required more
                    // than one frame, this is relatively unlikely so just
                    // resample since there's enough data to ensure that
                    // the next sample will be written.
                    continue
                }
            }
            iatWrLen, err = frameBuf.Read(iatFrame[:targetLen])
        }