spoofdpi is a cross-platform proxy tool that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes. It operates in three modes: HTTP proxy, SOCKS5 proxy, or TUN interface (transparent proxy). In production, it intercepts outgoing connections, reads the TLS ClientHello, splits it into segments using configurable strategies (SNI-split, random, chunk, first-byte, or custom plans), optionally sends fake packets before the real data, and may disorder segments by manipulating the TTL field so that DPI middleboxes misparse the connection while the destination server reassembles it correctly. It also includes a built-in DNS resolver with UDP, HTTPS (DoH), and system backends, and a rule system for per-domain/per-IP configuration. The architecture is a single Go binary with modular internal packages: config (TOML+CLI loading), desync (TLS/UDP desynchronization), dns (multi-backend resolver), netutil (connection management, dialing, TTL setting), packet (raw packet capture/injection via pcap or Linux raw sockets), proto (HTTP, SOCKS5, TLS parsing), rule (domain and CIDR matching), server (HTTP, SOCKS5, TUN server implementations), session (context-based tracing), trie (generic trie structures), cache (sharded LRU and TTL caches), and logging (zerolog-based structured logging). The TUI mode uses bubbletea for a terminal interface showing real-time speed and logs. Key entry points are cmd/spoofdpi/main.go (main function) which parses CLI flags, loads configuration, and starts the selected server. External dependencies include gopacket for packet manipulation, wireguard-tun for TUN device support, gvisor for TCP/IP stack in TUN mode, and various Go packages for CLI, TOML, DNS, and logging. The code is well-structured with extensive use of interfaces, generics, and concurrency primitives (context, channels, goroutines).
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship by fragmenting the TLS ClientHello so the SNI never appears whole in a single packet, and by resolving DNS over encrypted channels (DoH/DoT). It is a ground-up TypeScript rewrite of the original GreenTunnel, fixing numerous bugs from v2 (backpressure, timeouts, HTTP framing corruption, DNS cache expiry, system proxy crash safety). The repository is a monorepo containing a core engine library, a CLI tool (`gt`), and an Electron desktop app. The engine implements a full HTTP/HTTPS proxy with TLS fragmentation, HTTP request rewriting (absolute-form to origin-form), a caching DNS resolver with TTL-based expiration and in-flight deduplication, and a system-proxy management layer with snapshot/restore and crash recovery. The desktop app provides a 340px frameless window with a live log panel (virtual list), tray integration, and non-intrusive advocacy prompts. The codebase is exceptionally well-documented (CLAUDE.md serves as the authoritative design document), uses modern Node.js features (parseArgs, styleText, pipeline), and has a strong emphasis on correctness and edge-case handling (e.g., stranded proxy detection, HTTP framing awareness, signal handling for clean shutdown).
nDPI is a production-grade open-source deep packet inspection (DPI) library written in C, developed primarily by ntop.org. It identifies hundreds of network protocols by inspecting packet payloads using static signatures, heuristics, state machines, and machine learning classifiers. The library extracts rich metadata (TLS fingerprints, DNS queries, HTTP headers, etc.), computes flow risks (malware, DGA, obfuscation, anomalies), and supports output serialization in JSON, CSV, or TLV formats. It is designed to be embedded into network monitoring applications such as ntopng, nProbe, and Wireshark (via a Lua extcap plugin), and also ships as a standalone CLI tool (ndpiReader) and Python bindings. The codebase is well-structured with a modular dissector pattern, extensive fuzzing infrastructure, and a comprehensive test suite. While the primary focus is on library reuse, it also contains research-grade components like DGA detection models (scikit-learn/TensorFlow) and time-series anomaly detection, giving it a hybrid character leaning heavily toward a software library.
RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
GoodbyeDPI is a Windows-based Deep Packet Inspection (DPI) circumvention utility that bypasses ISP-imposed website blocks. It operates as a monolithic console application or Windows service that uses the WinDivert driver to intercept, analyze, and modify network packets at the NDIS layer. The software implements multiple evasion techniques including TCP fragmentation, HTTP header manipulation (Host header modification, spacing removal, case mixing), DNS redirection, and fake packet generation with altered TTL, checksum, or sequence numbers. It features a modular architecture with separate modules for packet filtering, connection tracking (DNS and TCP TTL), blacklist/whitelist management, and fake packet generation. The application runs with administrator privileges and supports both passive DPI (packet dropping) and active DPI circumvention (packet modification) strategies.