Aroma: Every TCP Proxy Is Detectable with RTT Fingerprinting
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version) This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly Custom VCL, they get this data from the Linux kernel (struct tcp_info -> tcpi_min_rtt and tcpi_rtt). I am using Fastly for the Demo since they have PoPs all around the world and they expose TCP socket data to me. The score is calculated by doing tcpi_min_rtt/tcpi_rtt. It's…
In plain words
Aroma is a detection tool that identifies TCP proxies by analyzing round-trip time fingerprints. It measures minimum and smoothed TCP RTT values from the Linux kernel using Fastly's Custom VCL to calculate a ratio score. The tool is designed for developers and network administrators who need to detect proxy usage in TCP connections. It flags connections with scores below 0.1 as likely proxies, accounts for unstable connections, and leverages Fastly's global network of points of presence for testing.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version) This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly Custom VCL, they get this data from the Linux kernel (struct tcp_info -> tcpi_min_rtt and tcpi_rtt). I am using Fastly for the Demo since they have PoPs all around the world and they expose TCP socket data to me. The score is calculated by doing tcpi_min_rtt/tcpi_rtt. It's simple but it's what worked best for this with the data Fastly gives me. Based on my testing, 1-0.7 is normal, 0.7-0.3 is normal if the connection is somewhat unstable (WiFi, mobile data, satellite...), 0.3-0.1 is low and may be a proxy, anything lower than 0.1 is flagged as TCP proxy by the current code.
Does the same job
all alternatives →- TYTest your WireGuard connectivity and see global stats, no client needed2024 · probe.sh · ▲43
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
- STSMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPIJan 2026 · github.com · ▲140
A fast SOCKS5 proxy that tunnels your traffic through what looks like normal SMTP email, bypassing Deep Packet Inspection firewalls. How it works: - Client runs a local SOCKS5 proxy (127.0.0.1:1080) - Traffic is sent to server disguised as SMTP (EHLO, STARTTLS, AUTH) - DPI sees legitimate email session, not a VPN/proxy Features: - One-liner install on any Linux VPS - Multi-user with per-user secrets and IP whitelists - Auto-generated client packages (just double-click to run) - Auto-reconnect on connection loss - Works with any app that supports SOCKS5 Tech: Python/asyncio, TLS…
- ATA toy version of Wireshark (student project)2025 · github.com · ▲265
Hi everyone, I recently published a small open-source project. It’s a minimal network packet analyzer written in Go — designed more like a learning toy than a replacement for Wireshark. It currently supports parsing basic protocols like TLS, DNS, and HTTP, and includes a tiny fuzzing engine to test payload responses. You can inspect raw packet content directly from the terminal. The output is colored for readability, and the code structure is kept simple and clear. The entire program is very small — just about 400 lines of Go code. I know it’s not anywhere near Wireshark’s level, and I still…
- UEUsing eBPF to see through encryption without a proxy2025 · github.com · ▲259
Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
- SASping – An HTTP/TCP latency tool that's easy on the eye2025 · dseltzer.gitlab.io · ▲178
I've frequently found myself using [nvitop](https://github.com/XuehaiPan/nvitop) to diagnose GPU/CPU contention issues. The two best things about it are: - It's easy to install if I can access pip in the container - It makes a compelling screenshot (which helps me communicate with coworkers.) With those two lessons in mind: Here is Sping! Purpose: Help observe and diagnose latency issues at layer 4+ (TCP/HTTP/HTTPS) Two good things about it: - It's easy to install if you have pip. (Available at…
- III integrated my from-scratch TCP/IP stack into the xv6-riscv OS2025 · github.com · ▲147
Hi HN, To truly understand how operating systems and network protocols work, I decided to combine two classic learning tools: the xv6 teaching OS and a from-scratch TCP/IP stack. I'm excited to share the result: my own from-scratch TCP/IP networking stack running directly inside the xv6-riscv (https://github.com/pandax381/xv6-riscv-net) kernel. The project uses a modern virtio-net driver, allowing it to run seamlessly in QEMU and communicate with the host machine. Key features: - From-Scratch Stack: The core is powered by microps…
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 2d ago · opentrailpaper.com
Launched alongside, December 2025
the whole month →- GP
Life & fun · Dec 2025 · dosaygo-studio.github.io
- JG
Hi everyone! My name's Luke and I made the original Jmail here alongside Riley Walz. We had a ton of friends collaborate on building out more of the app suite last night in lieue of DOJ's "Epstein files" release. Please AMA!
Life & fun · Dec 2025 · jmail.world
PlanEat AI▲733AI turns your health goals into a 7-day menu & grocery list
AI · Dec 2025 · planeatai.com
- 2G
Community, All the HN belong to you. This is an archive of hacker news that fits in your browser. When I made HN Made of Primes I realized I could probably do this offline sqlite/wasm thing with the whole GBs of archive. The whole dataset. So I tried it, and this is it. Have Hacker News on your device. Go to this repo (https://github.com/DOSAYGO-STUDIO/HackerBook): you can download it. Big Query -> ETL -> npx serve docs - that's it. 20 years of HN arguments and beauty, can be yours forever. So they'll never die. Ever. It's the unkillable static archive of HN and it's…
Dev tools · Dec 2025 · hackerbook.dosaygo.com
