SNI Spoofing

English · فارسی · Русский · 中文

Caspian SNI spoofing for DPI circumvention

This guide covers optional deep packet inspection (DPI) circumvention in feature/sni, not the current released installer.

SNI is the server name in a TLS greeting. This feature sends an extra greeting with a spoof name before the real proxy stream. The real TLS or REALITY name in your imported config stays unchanged. An imported sni value does not automatically enable spoofing.

Set a spoof name

1. Save your proxy config in the panel.
2. Open SNI spoofing (optional) on the dashboard.
3. Enter a domain name, such as cover.example.invalid for a local test.
4. Save the setting.

Use a suitable domain for your actual network; the example domain cannot resolve. If Caspian is on, saving reconnects it with the new setting. To disable spoofing, clear the field and save it. Replacing the config clears the previous spoof name. Selecting another entry or refreshing a subscription preserves it.

State compatibility

This branch writes state schema version 4. Older builds refuse this state file to prevent data loss. Keep a pre-upgrade state backup if you need to return to an older build.

Limits

This version supports VLESS, VMess, and Trojan over IPv4 TCP, including WebSocket, HTTPUpgrade, and gRPC. It does not support Hysteria2, QUIC, SOCKS, Shadowsocks, XHTTP, or IPv6-only servers. SOCKS can negotiate a separate UDP endpoint that this TCP forwarder cannot cover. Native Shadowsocks UDP, including tunnel DNS traffic, cannot use this TCP-only forwarder. The forwarder chooses the first available IPv4 address from the detected server addresses. If confirmation fails, it closes the connection without forwarding the real stream. It does not fall back to an ordinary connection.

Windows x64 needs the WinDivert files included in the local installer build. Windows ARM64 cannot use this feature. Linux needs packet-socket privileges; macOS needs access to a BPF device on an Ethernet-style interface. The privileged Caspian service owns these resources and closes them when it stops.

The Windows loopback test proves that the server receives the real stream unchanged. It does not prove that spoofing works against your provider's filtering. Linux and macOS builds also need live packet tests on their target systems.

Credits

The primary source and idea are patterniha/SNI-Spoofing, licensed under GPL-3.0. See third-party credits and the source review.

DPI bypass, SNI spoofing, and security

Is Caspian DPI safe?

There is no universal DPI-safe guarantee. Optional SNI spoofing attempts to influence how a filtering system reads the initial TCP traffic. It does not hide the server IP, traffic volume, or timing, and a provider can still block the connection. The feature/sni implementation keeps the real TLS identity and rejects failed spoof confirmation instead of sending the real stream directly.

Does Caspian include GoodbyeDPI or zapret?

No. GoodbyeDPI and zapret are research references for possible future strategies. The primary SNI code and idea come from patterniha/SNI-Spoofing, with GPL attribution preserved. Caspian does not bundle those other projects or claim their authors endorse it.

Does a config with SNI enable DPI bypass automatically?

No. The imported SNI is the real server identity. Set the separate optional spoof name to enable this mode. Read SNI setup and limitations before enabling it.

Caspian guides: setup and supported protocols · SNI spoofing for DPI circumvention: setup and limits.

Validation evidence (English) · گزارش اعتبارسنجی فارسی.