spoofdpi is a high-performance, cross-platform proxy tool written in Go that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes and UDP packets. It operates in three modes: HTTP proxy, SOCKS5 proxy, and TUN interface (transparent proxy). The architecture is modular and clean, with clear separation of concerns: a config layer (TOML + CLI flags), a rule engine for domain/CIDR-based policy matching, a DNS resolver with multiple backends (UDP, DoH, system), a packet capture/injection layer using pcap or Linux raw sockets, and a desync engine that applies configurable split strategies (SNI, chunk, random, custom) and fake packets. The codebase demonstrates strong engineering practices: extensive use of interfaces for platform-specific code (Darwin/Linux/FreeBSD stubs), generic data structures (sharded LRU cache, TTL cache, domain trie with wildcard/globstar), concurrent connection management with idle timeouts, and structured logging with trace IDs. It includes a TUI mode using Bubble Tea. The project is actively maintained with recent commits, comprehensive CI/CD, and thorough test coverage for configuration parsing, rule matching, and desync logic. The code is of high quality and contains several reusable components.
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship. It works by intercepting HTTPS CONNECT tunnels, detecting the TLS ClientHello, and splitting it into fragments (either TCP segments or valid TLS records) so that the SNI (Server Name Indication) containing the target hostname never appears whole in a single packet. DNS resolution is performed over encrypted channels (DoH/DoT) to prevent ISP-level blocking. The repository contains a complete TypeScript rewrite of the engine, a CLI tool (`gt`), and an Electron desktop app. The engine is deliberately separated from the OS proxy configuration (handled by `SystemProxy`) and from the CLI output, making it testable and crash-safe. The codebase demonstrates strong engineering practices: proper error handling (no silent catch-and-return), backpressure-aware socket writes, framing-aware HTTP request rewriting, and a crash-proof system-proxy snapshot/restore mechanism. The desktop app features a live log panel with virtual scrolling, a tray icon, and a modal star/share prompt scheduled over three asks. The repository is actively maintained with modern tooling (Node 24, TypeScript 6, Electron 43, Vitest 4) and has a comprehensive test suite and CI/CD pipeline.
nDPI is a production-grade open-source deep packet inspection (DPI) library written in C, developed primarily by ntop.org. It identifies hundreds of network protocols by inspecting packet payloads using static signatures, heuristics, state machines, and machine learning classifiers. The library extracts rich metadata (TLS fingerprints, DNS queries, HTTP headers, etc.), computes flow risks (malware, DGA, obfuscation, anomalies), and supports output serialization in JSON, CSV, or TLV formats. It is designed to be embedded into network monitoring applications such as ntopng, nProbe, and Wireshark (via a Lua extcap plugin), and also ships as a standalone CLI tool (ndpiReader) and Python bindings. The codebase is well-structured with a modular dissector pattern, extensive fuzzing infrastructure, and a comprehensive test suite. While the primary focus is on library reuse, it also contains research-grade components like DGA detection models (scikit-learn/TensorFlow) and time-series anomaly detection, giving it a hybrid character leaning heavily toward a software library.
RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
GoodbyeDPI is a Windows-based Deep Packet Inspection (DPI) circumvention utility that bypasses ISP-imposed website blocks. It operates as a monolithic console application or Windows service that uses the WinDivert driver to intercept, analyze, and modify network packets at the NDIS layer. The software implements multiple evasion techniques including TCP fragmentation, HTTP header manipulation (Host header modification, spacing removal, case mixing), DNS redirection, and fake packet generation with altered TTL, checksum, or sequence numbers. It features a modular architecture with separate modules for packet filtering, connection tracking (DNS and TCP TTL), blacklist/whitelist management, and fake packet generation. The application runs with administrator privileges and supports both passive DPI (packet dropping) and active DPI circumvention (packet modification) strategies.