Aroma: Every TCP Proxy Is Detectable with RTT Fingerprinting
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version) This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly Custom VCL, they get this data from the Linux kernel (struct tcp_info -> tcpi_min_rtt and tcpi_rtt). I am using Fastly for the Demo since they have PoPs all around the world and they expose TCP socket data to me. The score is calculated by doing tcpi_min_rtt/tcpi_rtt. It's…
Aroma: Every TCP Proxy Is Detectable with RTT Fingerprinting launched on December 25, 2025 with 86 votes, #356 of 11,628 launches that month and more than 95% of that year's launches.
In plain words
Aroma is a detection tool that identifies TCP proxies by analyzing round-trip time fingerprints. It measures minimum and smoothed TCP RTT values from the Linux kernel using Fastly's Custom VCL to calculate a ratio score. The tool is designed for developers and network administrators who need to detect proxy usage in TCP connections. It flags connections with scores below 0.1 as likely proxies, accounts for unstable connections, and leverages Fastly's global network of points of presence for testing.
written from the facts on this page · September 2026
From the sources
Every TCP Proxy Is Detectable With RTT Fingerprinting - Sakura-sx/Aroma
I have to admit I was a bit surprised that Aroma was detecting WARP, since I thought it was a VPN, but apparently it acts like a UDP => TCP proxy. If Aroma doesn't detect your VPN, that's normal and means your VPN is doing Layer 3 proxying. If your VPN is detected it's doing Layer 4 proxying (some privacy VPNs do this on web ports for privacy reasons). And you should see an "allowed" page if you are not using a TCP Proxy and a block page if you are using a proxy. If you want to get your score you can go to https://aroma.global.ssl.fastly.net/score . Synthient provides real-time data on residential proxies, VPNs and malicious IP addresses enabling businesses to detect fraudulent traffic.…from github.com
In the maker’s words, at launch
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version) This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly…
Does a similar job
all alternatives →- TYTest your WireGuard connectivity and see global stats, no client needed2024 · probe.sh · ▲43
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
Check if your IP has appeared in a residential proxy networkSep 2026 · haveibeenproxied.com · ▲76Check whether your public IP has been observed participating in a residential proxy network. A free tool powered by Spur Intelligence.
SMTP Tunnel – A SOCKS5 proxy disguised as email traffic to bypass DPIJan 2026 · github.com · ▲140A fast SOCKS5 proxy that tunnels your traffic through what looks like normal SMTP email, bypassing Deep Packet Inspection firewalls. How it works: - Client runs a local SOCKS5 proxy (127.0.0.1:1080) - Traffic is sent to server disguised as SMTP (EHLO, STARTTLS, AUTH) - DPI sees legitimate email session, not a VPN/proxy Features: - One-liner install on any Linux VPS - Multi-user with per-user secrets and IP whitelists - Auto-generated client packages (just double-click to run) - Auto-reconnect on connection loss - Works with any app that supports SOCKS5 Tech: Python/asyncio, TLS…
A toy version of Wireshark (student project)2025 · github.com · ▲265Hi everyone, I recently published a small open-source project. It’s a minimal network packet analyzer written in Go — designed more like a learning toy than a replacement for Wireshark. It currently supports parsing basic protocols like TLS, DNS, and HTTP, and includes a tiny fuzzing engine to test payload responses. You can inspect raw packet content directly from the terminal. The output is colored for readability, and the code structure is kept simple and clear. The entire program is very small — just about 400 lines of Go code. I know it’s not anywhere near Wireshark’s level, and I still…
Using eBPF to see through encryption without a proxy2025 · github.com · ▲259Hi HN, I'm Tyler Flint, one of the creators of qtap. For a while now, my team and I at Qpoint.io have been grappling with the challenge of understanding what's actually happening inside the encrypted traffic leaving our production systems. Modern apps rely heavily on third-party APIs (think payment processors, data providers, etc.), but once TLS kicks in, figuring out exactly what data is being sent, identifying PII exposure, or debugging integration issues becomes incredibly difficult without resorting to complex and often brittle solutions. Traditional approaches like forward proxies…
- SASping – An HTTP/TCP latency tool that's easy on the eye2025 · dseltzer.gitlab.io · ▲178
I've frequently found myself using [nvitop](https://github.com/XuehaiPan/nvitop) to diagnose GPU/CPU contention issues. The two best things about it are: - It's easy to install if I can access pip in the container - It makes a compelling screenshot (which helps me communicate with coworkers.) With those two lessons in mind: Here is Sping! Purpose: Help observe and diagnose latency issues at layer 4+ (TCP/HTTP/HTTPS) Two good things about it: - It's easy to install if you have pip. (Available at…
More dev tools this month
the category →
Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.
Dev tools · 19h ago · github.com
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 29d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 27d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 22d ago · talanoa.email
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, December 2025
the whole month →- GP
Life & fun · Dec 2025 · dosaygo-studio.github.io
Hi everyone! My name's Luke and I made the original Jmail here alongside Riley Walz. We had a ton of friends collaborate on building out more of the app suite last night in lieue of DOJ's "Epstein files" release. Please AMA!
Life & fun · Dec 2025 · jmail.world
PlanEat AI▲733AI turns your health goals into a 7-day menu & grocery list
AI · Dec 2025 · planeatai.com
Community, All the HN belong to you. This is an archive of hacker news that fits in your browser. When I made HN Made of Primes I realized I could probably do this offline sqlite/wasm thing with the whole GBs of archive. The whole dataset. So I tried it, and this is it. Have Hacker News on your device. Go to this repo (https://github.com/DOSAYGO-STUDIO/HackerBook): you can download it. Big Query -> ETL -> npx serve docs - that's it. 20 years of HN arguments and beauty, can be yours forever. So they'll never die. Ever. It's the unkillable static archive of HN and it's…
Dev tools · Dec 2025 · hackerbook.dosaygo.com
