The open-source tool NoDPI, designed for network traffic modification, has received a critical update to version 2.3. The developer released the fix on GitHub on October 25 to address issues where DPI systems began reassembling fragmented ClientHello packets, rendering previous bypass methods ineffective.
The new approach, dubbed 'disorder', involves manipulating TCP segment order. The first segment containing the SNI field is sent with a TTL of 1, causing it to drop before reaching the inspection system, while the rest of the packet is sent with a normal TTL. The operating system kernel then retransmits the first segment after approximately 200 ms, allowing the server to reconstruct the full handshake.
This implementation utilizes the standard setsockopt library, requiring no administrative privileges or raw sockets. The method adds a latency of about 200 ms to the initial connection establishment but does not impact data transfer speeds. The update also removes legacy fragmentation methods and improves the reading of ClientHello packets.
Future development plans for the project include implementing DNS-over-HTTPS resolution to prevent DNS spoofing and exploring methods to bypass restrictions for protocols like MTProto. These updates are also intended for the Android port of the tool, NoDPI4Android.
