What is Free Data (Mianliu)?

"Free data" (Mianliu) refers to using specific apps or services on a mobile network without consuming your data plan—essentially, using the internet for free. It is typically offered by mobile carriers or specific app providers to attract more users to those apps or services.

Basic Principle of Free Data

The free data mentioned above is usually limited to certain apps. The free data we are discussing is not limited to specific apps; it achieves free usage by tricking the carrier's billing system through specific methods.

First, we need to understand how the carrier's billing system works.

Accessing a normal website:

Accessing a free data website:

The core principle of free data is to make the billing system think the user is accessing a free data website, while actually accessing a normal website.

Several Methods of Free Data

Local Free Data

Local free data involves running a proxy program on the user's phone to modify all data packets, thereby tricking the billing system.

The main implementation method of the proxy program is to modify the HTTP request headers.

There are two key fields in the request header: Host and X-Online-Host. Suppose the billing system charges based on the Host field in the HTTP packet, while the proxy server uses the X-Online-Host field in the HTTP packet for actual data access. Then, by modifying the Host field in the HTTP headers, you can trick the billing system.

The carriers are not stupid; they updated their detection systems, and the above methods became ineffective. Subsequently, netizens began a cat-and-mouse game with the carriers.

1. The dual-H mode, inserting two Host fields, letting the billing system check the first Host field and the proxy server check the second Host field.
1. The dual-X mode, inserting two X-Online-Host fields.
1. Pseudo-header mode.
1. Pseudo-color mode.
1. .....

The advantage of local free data is that it requires no additional resources and can be implemented on the user's local phone, mainly exploiting the implementation differences between the carrier's billing system and the proxy server system. The disadvantage is that the system differences vary by region; a mode that works in Shanghai may not work in Guangdong. Moreover, the exploitable modifications are limited, and once all modes are blocked, they become unusable.

The biggest problem with local free data was the delay in carrier billing updates. When a previously used free data mode was fixed, data would start being charged normally without the user's knowledge. The next morning, they would wake up to a huge bill from 10086.

Directional Free Data

Starting in 2015, the government required the three major carriers to increase speeds and reduce fees. Roaming charges were gradually eliminated, data became nationwide, and costs decreased, but data fees were still not low enough to be used carelessly.

For people who like watching Douyin or Tencent Video, the three major carriers launched directional data cards, such as Tencent King Card and Alibaba Baby Card. Directional data cards provide large amounts of directional data for certain internet services on top of general data. For example, the Tencent King Card allows free use of up to 40GB of data for Tencent apps.

Cloud Free Data (Cloud Mian)

Local free data exploited the differences between the billing system and the proxy server. Over time, these differences were gradually patched (thanks to netizens who provided volunteer QA testing). Eventually, carriers even eliminated the proxy server, using the billing system directly for internet access, making local free data obsolete. The commonly used method now is cloud free data, which is the mainstream approach.

The principle of cloud free data requires some basic knowledge of network protocols, specifically how TCP/IP works.

IP

The current internet is built on the TCP/IP architecture. Communication between computers is based on the IP protocol, not domain names.

The IP protocol can be thought of as a phone number for a computer. For example, to contact Zhang San, we can dial his phone number 123456 to reach him.

DNS

Currently, we access websites by entering domain names. But since computer communication is based on the IP protocol, how is the conversion done?

This is what DNS does. Because IP addresses are hard to remember and type, domain names were invented to simplify input. They are like contact names in a phonebook. For example, we save Zhang San's phone number as 123456 in our contacts. Zhang San is like the domain name, and 123456 is the IP. To contact Zhang San, we just search for 'Zhang San' in the phonebook instead of entering 123456.

DNS acts as the phonebook lookup. For instance, when I want to visit google.com, my computer doesn't know how to reach google.com directly, so it queries the phonebook (DNS query) for google.com's phone number (IP).

HTTP

The HTTP protocol is the most common internet protocol for ordinary people and is the foundation of the internet. Almost all common applications communicate using the HTTP protocol.

The structure of an HTTP request is as follows:

BASH

GET / HTTP/1.1
Host: www.baidu.com

xxxxxxxThis is the HTTP request bodyxxxxxxx

In local free data, we modified the Host field to bypass the billing system. In cloud free data, the approach is similar, but the difference lies in how to access the correct target website after bypassing the billing system.

The idea is simple: since local free data was completely fixed by merging the carrier's proxy server and billing system, if we could implement our own proxy server, wouldn't it be similar to the previous method?

Cloud Free Data Principle

Specifically, the original request is encapsulated into the HTTP body and sent to the proxy server. The proxy server parses the HTTP body, restores the original request, and makes the actual request.

That is:

Direct Connection Free Data

There is another type of directional free data that does not require a cloud server. Some directional cards allow free data for all traffic from a specific app, not just a specific domain. For example, the Tencent King Card can exempt all traffic from the QQ Browser. The principle is that a built-in proxy server is embedded in the app, and the traffic generated by this proxy server is counted as directional data by the carrier.

Direct connection free data involves capturing the built-in proxy server from the app and using it for all app access.

However, because proxy servers now have dynamic authentication, this method is mostly obsolete.

Suspended Account Free Data

China Telecom provides a green channel for recharging after a user's account is suspended. This allows users to still access the network to pay their bills even after suspension. Similar to directional free data, the principle of suspended account free data is to change the Host to the green channel's URL to achieve free data.

For suspended users, they only need to pay the monthly suspension fee (usually 5 yuan) to enjoy unlimited data. However, Telecom quickly implemented countermeasures, imposing speed limits on suspended users in most regions. After all, why would you need fast internet just to recharge your phone bill?

Limitations of Free Data

Because how the carrier's billing system works is essentially a black box, it's difficult for outsiders to know when the working mechanism will change. For example, besides checking the Host field, the billing system can also check the port. Internet traffic typically uses ports 80/443, so the cloud server's port must usually be 80/443.

To achieve free data, a global proxy must be used, meaning all traffic, both domestic and international, must be routed through the cloud server.