Sniffing: skip the content sniffer for configured destination ports

[rokokol]

What this is about

Content sniffing costs a fixed ~200 ms on every connection whose server speaks first — SSH, IMAP, SMTP, MySQL, RDP. The client sends nothing, so sniffer() in app/dispatcher/default.go spends its whole budget before giving up:

cacheDeadline := 200 * time.Millisecond
...
cacheDeadline -= cachingTimeElapsed
...
if totalAttempt >= 2 || cacheDeadline <= 0 {
    return nil, errSniffingTimeout
}

The outcome is graceful — contentErr != nil && metadataErr == nil returns the metadata result and the connection proceeds — but the wait has already been paid.

Measurement

Xray-core v26.7.28. One host, SOCKS inbound → freedom outbound, destination github.com:22. Time from the SOCKS reply to the first byte of the SSH banner, median of 9 runs each:

Inbound sniffing setting	Median TTFB	Range
enabled: false	201 ms	188–207
enabled: true	399 ms	389–406
enabled: true + domainsExcluded: ["github.com"]	398 ms	390–414
enabled: true + metadataOnly: true	195 ms	185–205

The penalty is a constant ~198 ms, independent of how far the destination is.

Config used — runs as is

{
  "log": { "loglevel": "warning" },
  "inbounds": [
    { "tag": "sniffing-off", "port": 10801, "listen": "127.0.0.1", "protocol": "socks",
      "settings": { "auth": "noauth", "udp": false },
      "sniffing": { "enabled": false } },
    { "tag": "sniffing-on", "port": 10802, "listen": "127.0.0.1", "protocol": "socks",
      "settings": { "auth": "noauth", "udp": false },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"] } },
    { "tag": "domains-excluded", "port": 10803, "listen": "127.0.0.1", "protocol": "socks",
      "settings": { "auth": "noauth", "udp": false },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"],
                    "domainsExcluded": ["github.com"] } },
    { "tag": "metadata-only", "port": 10804, "listen": "127.0.0.1", "protocol": "socks",
      "settings": { "auth": "noauth", "udp": false },
      "sniffing": { "enabled": true, "destOverride": ["http", "tls", "quic"],
                    "metadataOnly": true } }
  ],
  "outbounds": [{ "protocol": "freedom" }]
}

Measured by opening the SOCKS connection, requesting github.com:22, then timing the first byte returned after the SOCKS reply.

Why the existing options don't cover this

domainsExcluded and ipsExcluded are evaluated in shouldOverride, after sniffer() has returned. The third row shows the consequence: excluding the exact destination changes the latency by nothing. That matches their documented purpose — they suppress the destination rewrite — and #5927 reads as though this placement is deliberate, so this is not a report that they are broken. The point is only that there is no knob acting before the read.

metadataOnly: true does avoid the wait, but it is per-inbound and disables content sniffing for everything on that inbound. It is unusable where the same inbound also carries HTTP/TLS traffic that routing rules match by domain — which is the common case.

Proposal

A portsExcluded in SniffingConfig, checked in the dispatcher immediately before the sniffer() call. The destination port is already known there, so this is a lookup with no extra parsing, and no behavioural change for anyone who leaves it unset.

An operator running a mixed workload behind one inbound — browser, mail client, git over SSH — could then keep domain-based routing and stop paying ~200 ms on every mail and SSH connection.

Happy to open a PR if the idea is welcome, and if portsExcluded is the shape you would want rather than, say, a portsIncluded whitelist.

Checked before posting

Searched issues and discussions for prior art. The closest is #5927 (domainsExcluded supporting geosite:) and the ipsExcluded follow-up discussed in it; neither touches the pre-sniff case.

[rokokol]

Sent it as #6661 — the field, the dispatcher check and tests, with before/after numbers in the PR body. Happy to reshape or drop it if the form is wrong.