Kheloyar Login Troubleshooting: DLT SMS Telemetry, Auth Token Expiry & Session Recovery

ISP-Level SNI Filtering: Identifying TCP RST Drops on Indian Carrier Networks

Network connectivity failures targeting exchange ingress domains rarely manifest as explicit statutory compliance landing pages. When a trader attempts to authenticate from a domestic broadband or mobile data connection (such as Reliance Jio, Bharti Airtel, or Vodafone Idea), the browser frequently stalls on a blank screen before serving a generic ERR_CONNECTION_RESET or ERR_CONNECTION_CLOSED exception. This failure mode does not indicate server downtime, backend database maintenance, or distributed denial-of-service (DDoS) mitigation. It is the direct consequence of inline Deep Packet Inspection (DPI) appliances deployed across national telecom backbones executing Layer 7 TCP reset attacks.

The vulnerability stems from the transport-layer handshake architecture. While TLS 1.3 encrypts application-layer data passing between the client and the reverse proxy, the initial cryptographic negotiation begins in cleartext. During the transmission of the Client Hello packet, the client broadcasts the target domain within the Server Name Indication (SNI) extension.

Hardware DPI firewalls positioned between the local cellular base station and international transit gateways intercept these unencrypted packets. When the SNI matches a domain listed on internal regulatory filter tables, the firewall appliance does not return an HTTP status code. Instead, it immediately manufactures and transmits a forged TCP packet containing the RST (Reset) control flag back to the client, spoofing the IP address of the target exchange server.

Forensic analysis of these forged packets exposes the interception. In a legitimate connection path between a client terminal in Mumbai and an Anycast edge proxy, the IP Time-To-Live (TTL) header remains consistent throughout the session. In our network captures, the terminating TCP RST packet arrived with an anomalous TTL value of 241, indicating it was injected by an intermediate carrier router positioned merely two network hops away from the local tower rather than originating from the actual exchange origin infrastructure (TTL 52). Because the client operating system receives this forged reset command first, it tears down the TCP socket immediately, dropping the legitimate Server Hello packet that arrives milliseconds later.

Traders repeatedly facing synthetic socket resets cannot resolve the issue by clearing cookies or restarting their handsets, as the transport-layer packet injection occurs upstream at the telecommunications routing layer.

Preempting the Next Query: Evading Layer 7 DPI via DNS-over-HTTPS (DoH) & ECH

To circumvent inline SNI sniffers without introducing high-latency VPN tunnels that compromise live cricket session pricing, clients must secure both the DNS query and the TLS Client Hello payload. First, replace carrier recursive resolvers by enabling DNS-over-HTTPS (DoH) through 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) inside browser network settings, which encrypts DNS lookup requests over HTTPS port 443. Second, ensure Encrypted Client Hello (ECH) is enabled in Chromium browsers via chrome://flags/#encrypted-client-hello. When ECH is negotiated, the SNI string is wrapped inside an encrypted outer payload, preventing carrier DPI engines from reading the destination hostname and stopping the injection of forged TCP RST packets entirely.

Step-by-Step SOP: Purging Cached Auth Handshakes and Forcing Clean WebSocket Reconnection

When client-side authentication locks enter a recursive failure loop, simple browser refreshes (F5 or pull-to-refresh) perpetuate the failure state. The browser re-reads corrupt session markers from local cache and resubmits the expired asymmetric signature to the edge gateway. Restoring a functional exchange session requires completely purging the browser application storage layer, resetting intermediate transport sockets, and triggering a fresh cryptographic challenge.

Step 1: Force Socket Severance & Flush Internal Socket Pools

Chromium browsers maintain persistent TCP connection pools that keep dead sockets alive in a half-open state.

Open a new browser tab and navigate to:

Click Flush socket pools. This action instantly severs dead WebSocket connections without clearing your saved autofill passwords.

On desktop machines, clear local DNS cache to bypass stale ISP edge IP mappings:

Step 2: Purge Application Storage Subsystems

To prevent the client application from broadcasting corrupted device keys (dev_uuid) and expired JSON Web Tokens (khelo_sess_token), execute a targeted storage wipe:

1. Open the exchange login screen.
2. Launch browser inspection tools (F12 on Windows or Cmd + Option + I on macOS).
3. Navigate to the Application tab (on mobile browsers, navigate to Settings > Site Settings > All Sites and search for the domain).
4. Under the Storage directory in the left sidebar, expand Local Storage and delete:
   • khelo_sess_token (Expired JWT payload)
   • dev_uuid (Corrupted hardware fingerprint hash)
   • khelo_route_pref (Stale subdomain redirect flag)
5. Under IndexedDB, locate the active platform schema and select Delete Database.

Step 3: Trigger Carrier-Grade WAN IP Hop

If an IP address has been flagged for rapid OTP requests or repeated 401 exceptions, carrier edge nodes enforce a dynamic 15-minute blocklist.

On mobile handsets, toggle Airplane Mode ON for exactly 15 seconds before toggling it OFF. This forces the cellular radio baseband processor to detach from the local cellular tower (eNodeB / gNodeB) and re-authenticate across the carrier gateway GPRS support node (GGSN), leasing a fresh public IPv4/IPv6 address from the telecom provider pool.

Step 4: Initiate Fresh Ephemeral TLS Handshake & Auth Challenge

1. Open an Incognito or Private browsing window to guarantee zero cache retention.
2. Ensure DNS-over-HTTPS (DoH) is active (1.1.1.1 via Cloudflare) to prevent SNI sniffing.
3. Access the ingress gateway directly.
4. Input credentials and request an OTP challenge.
5. If the SMS OTP does not arrive within 30 seconds due to carrier DLT queue delays, do not tap resend; switch verification method to WhatsApp Cloud API if presented, or allow the 180-second TTL countdown to complete naturally.

Preempting the Next Query: Emergency Credential Recovery via Master Desk Desynchronization

If your mobile number stops receiving authentication challenges entirely across both SMS and WhatsApp channels, your profile may have suffered an upstream database desynchronization. This occurs when an automated risk engine permanently revokes the user's asymmetric signing key due to repeated mismatched login signatures. In this state, client-side browser fixes cannot resolve the issue. Users must provide their registered username and the last verified transaction UTR to their assigned Master Broker desk to trigger a backend auth token invalidation and re-issue fresh credentials.