> ## Documentation Index
> Fetch the complete documentation index at: https://e-gurl.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# DPI Evasion (TLS Fragmentation)

> Bypass Deep Packet Inspection by fragmenting TLS ClientHello

# DPI Evasion — TLS Fragmentation

Added in v4.0.0, TLS fragmentation bypasses Iran's Deep Packet Inspection (DPI) systems that block encrypted DNS based on the SNI field in TLS handshakes.

## How DPI Blocking Works

Iran's DPI inspects the **first TCP segment** of TLS connections to read the **Server Name Indication (SNI)** — the hostname the client is connecting to. If the SNI matches a blocked domain (or a known DNS provider), the connection is reset.

## How Fragmentation Defeats DPI

By splitting the TLS ClientHello across **multiple TCP segments**, the SNI is no longer visible in any single packet. Most DPI systems only inspect the first packet or cannot reassemble fragmented TLS handshakes.

## Fragmentation Modes

| Mode      | Strategy                                           | Best For                                          |
| --------- | -------------------------------------------------- | ------------------------------------------------- |
| `sni`     | Split at the SNI extension boundary                | **Recommended** — most targeted and effective     |
| `random`  | Random split point with random delay (NoDPI-style) | Evades pattern-based DPI that learns split points |
| `half`    | Split the ClientHello in the middle                | Good fallback if SNI mode doesn't work            |
| `chunked` | Split into 40-byte fragments                       | Most aggressive — works against sophisticated DPI |

## Usage

Fragmentation is enabled via the `--fragment` flag on the proxy command:

```bash theme={null}
# Recommended: fragment at SNI boundary
dns-mns proxy --fragment sni

# Random split point (NoDPI-style, varies each connection)
dns-mns proxy --fragment random

# Split in half
dns-mns proxy --fragment half

# Maximum fragmentation (40-byte chunks)
dns-mns proxy --fragment chunked

# Combine with protocol preference
dns-mns proxy --protocol doh --fragment sni
```

### Interactive Mode

When starting the DoH/DoT proxy from the interactive menu (**Encrypted DNS → DoH/DoT Proxy**), you'll be prompted to choose a DPI evasion mode:

1. **SNI-targeted** — Split at the SNI extension boundary
2. **Random (NoDPI-style)** — Randomized split point and delay
3. **None** — No fragmentation

## How It Works Internally

1. The proxy intercepts the first `Write` on each new TLS connection
2. It detects if the data is a TLS ClientHello (byte `0x16` + handshake type `0x01`)
3. For `sni` mode: it parses the ClientHello to find the SNI extension offset
4. It splits the data at the chosen point and sends each piece as a separate TCP segment
5. A configurable delay (default 10ms) is added between fragments
6. Subsequent writes pass through unchanged

## Technical Details

* **Delay between fragments:** 10ms fixed for SNI/half/chunked modes; 1–50ms random for `random` mode
* **Chunk size (chunked mode):** 40 bytes
* **TCP\_NODELAY:** Enabled on all fragment connections to prevent OS from coalescing small TCP segments
* **TLS version spoofing:** Outer record layer advertises TLS 1.3 (0x0304) to confuse DPI
* **Applies to:** DoH and DoT connections through the smart proxy and DoH/DoT proxy
* **Does not affect:** DNSCrypt (already encrypted from first packet)
* **Performance impact:** Minimal — only the first packet of each TLS handshake is fragmented

## TLS Fingerprint Spoofing (uTLS)

Iran's DPI also uses TLS fingerprinting (JA3/JA4) to identify and block proxy/VPN traffic based on the cipher suites and extensions your client advertises. DNS-MNS uses [uTLS](https://github.com/refraction-networking/utls) to mimic real browser TLS fingerprints.

The `--fingerprint` flag is available on proxy commands:

```bash theme={null}
# Recommended for Iran: Firefox fingerprint
dns-mns proxy --fingerprint firefox

# Other browser fingerprints
dns-mns proxy --fingerprint chrome
dns-mns proxy --fingerprint safari

# Random fingerprint per connection
dns-mns proxy --fingerprint random
```

### Available Fingerprints

| Fingerprint | Description                                |
| ----------- | ------------------------------------------ |
| `firefox`   | Mozilla Firefox — **recommended for Iran** |
| `chrome`    | Google Chrome (most common)                |
| `safari`    | Apple Safari                               |
| `edge`      | Microsoft Edge                             |
| `ios`       | iOS Safari                                 |
| `android`   | Android Chrome                             |
| `random`    | Random browser per connection              |

### Combining Fingerprint + Fragmentation

For maximum evasion, use both techniques together:

```bash theme={null}
dns-mns proxy --fragment sni --fingerprint firefox
```

***

## Troubleshooting

**Fragmentation not working?**

* Try `chunked` mode — it's the most aggressive
* Increase the delay between fragments if your DPI is timing-aware
* Some ISPs use stateful DPI that can reassemble fragments; in that case, try a different protocol (DNSCrypt)

**Connection timeouts?**

* Some servers reject connections from overly fragmented clients
* Try `half` mode which only creates 2 fragments