DOCSEARCHbyAlgolia
Submit Docs

byedpi

repository·main·Indexed 23 days ago

https://github.com/hufrea/byedpi

A local SOCKS proxy server designed to bypass Deep Packet Inspection (DPI) by manipulating TCP/TLS packet characteristics. It implements various bypass methods including packet fragmentation, disordering, TTL manipulation, and fake packets. Supports protocol whitelisting, automatic bypass mode detection, and outbound proxy connections via schemes such as SOCKS, Shadowsocks, and HTTP.

Tokens
1.9K
Snippets
1
Records
16
Agent score
36%

What's inside byedpi

  1. Overview of byedpi

    main
    byedpi is a local SOCKS proxy server designed to implement various DPI (Deep Packet Inspection) bypass methods. It allows users to circumvent network restrictions by manipulating packet characteristics such as TTL, fragmentation, and ordering.

  3. Optimize byedpi for Linux vs Windows

    main

    Bypass strategies differ significantly by operating system due to how TCP retransmission is handled.

    Linux Recommended Patterns:

    • Simple disorder: --disorder 1
    • Fake packets: --fake -1 --md5sig

    Windows Recommended Patterns:

    • Simple disorder: --split 1+s --disorder 3+s
    • Fake packets: --disorder 1 --fake -1

    General Example:

    ciadpi --disorder 1 --auto=torst --tlsrec 1+s
ciadpi --fake -1 --ttl 8

  4. Build byedpi from source

    main

    To build the project, you need make and a C compiler (gcc or clang for Linux, or mingw for Windows).

    Linux:

    make

    Windows:

    make windows CC=x86_64-w64-mingw32-gcc
    make
make windows CC=x86_64-w64-mingw32-gcc

  5. Configure byedpi automatic bypass modes

    main

    The --auto flag allows you to define groups of bypass parameters that are applied only when specific triggers occur.

    Triggers for --auto <t,r,s,n>:

    • torst: Connection timeout or server reset after the first request.
    • redirect: HTTP Redirect with a Location header that doesn't match the outgoing domain.
    • ssl_err: No ServerHello received after ClientHello, or invalid session_id in SH.
    • none: Skips the previous group (e.g., due to domain or protocol restrictions).

    Auto Mode (--auto-mode <0-3>):

    • 0: Cache IP only if reconnection is possible.
    • 1: Cache IP if torst or ssl_err occurs during initial packet exchange.
    • 2: Sort groups by trigger frequency (ascending).
    • 3: Both 1 and 2.

    Example: Apply different TTLs based on error type:

    ciadpi --fake -1 --ttl 10 --auto=ssl_err --fake -1 --ttl 5

  6. Configure byedpi packet fragmentation and manipulation

    main

    Use these flags to manipulate packet structure to bypass DPI:

    • -s, --split <pos_t>: Split request at a specific position. Format: offset[:repeats:skip][+flag1[flag2]]. Flags: +s (SNI offset), +h (Host offset), +n (zero offset), +e (end), +m (middle).
    • -d, --disorder <pos_t>: Similar to --split, but parts are sent in reverse order.
    • -o, --oob <pos_t>: Similar to --split, but part is sent as Out-of-Band (OOB) data using the URG flag.
    • -q, --disoob <pos_t>: Similar to --disorder, but part is sent as OOB data.
    • -f, --fake <pos_t>: Similar to --disorder, but a fake part is sent before the first real part.
    • -t, --ttl <num>: TTL for the fake packet (default: 8).
    • -r, --tlsrec <pos_t>: Split ClientHello into separate TLS records at the specified offset.
    • -m, --tlsminor <ver>: Changes the third byte of the TLS record to the specified value.
    • -M, --mod-http <h[,d,r]>: HTTP packet manipulations: hcsmix (case mix Host), dcsmix (case mix Host), rmspace (remove space in Host).

  7. Configure byedpi filtering and restrictions

    main

    Restrict which traffic is processed using these flags:

    • -K, --proto <t,h,u,i>: Protocol whitelist: tls, http, udp, ipv4.
    • -H, --hosts <file|:string>: Limit scope to a list of domains (separated by newline or space).
    • -j, --ipset <file|:str>: Limit scope to specific IPs or subnets.
    • -V, --pf <port[-portr]>: Limit scope to specific port ranges.

  8. Configure byedpi operational modes

    main

    Control how the proxy runs and handles connections:

    • -D, --daemon: Run in daemon mode (Linux and BSD only).
    • -w, --pidfile <filename>: Location of the PID file.
    • -E, --transparent: Run in transparent proxy mode (SOCKS functionality is disabled).
    • -U, --no-udp: Do not proxy UDP traffic.
    • -F, --tfo: Enable TCP Fast Open (Linux 4.11+ only).
    • -Y, --drop-sack: Ignore SACK (Selective Acknowledgement), forcing the kernel to retransmit delivered packets (Linux only).

  9. Configure byedpi SOCKS proxy settings

    main

    Use the following flags to configure the listening interface and port for the SOCKS proxy:

    • -i, --ip <ip>: Listening IP (default: 0.0.0.0).
    • -p, --port <num>: Listening port (default: 1080).
    • -c, --max-conn <count>: Maximum client connections (default: 512).
    • -I, --conn-ip <ip>: IP address to bind outgoing connections to (default: ::). Specifying an IPv4 address will reject IPv6 requests.

  11. Configure Whitelists and Protocol Filtering

    main

    Restrict which hosts, IPs, or protocols ByeDPI will process.

    • -K, --proto <t,h,u,i>: Protocol whitelist. Options: tls, http, udp, ipv4.
    • -H, --hosts <file|:str>: Hosts whitelist. Provide a filename or a colon-prefixed string (e.g., :example.com).
    • -j, --ipset <file|:str>: IP whitelist. Provide a filename or a colon-prefixed string.
    • -V, --pf <port[-portr]>: Port range whitelist (e.g., 80-443).

  12. Configure ByeDPI Listening IP and Port

    main

    Set the local address and port that ByeDPI will listen on. By default, it listens on 0.0.0.0:1080.

    • -i, --ip <ip>: Specify the listening IP address.
    • -p, --port <num>: Specify the listening port number.