The Obfuscation Zoo: Why One Protocol Is No Longer Enough to Survive in the Modern Internet

Imagine you are shipping valuable cargo across a city filled with checkpoints and scanners. A standard freight truck with a bright sign reading "Protected Special Cargo" (representing classic OpenVPN or WireGuard) gets pulled over at the very first intersection: the patrol doesn't even look inside; they instantly recognize the shape of the body and impound the vehicle. To get through, you have to swap transport for every single district.

In one neighborhood, the cargo is transferred into a standard urban delivery van bearing a well-known supermarket's logo: from the outside, it looks like an ordinary run for groceries, the waybills are in order, and the scanner sees a legitimate barcode. In another district, the asphalt is shattered with constant traffic jams and jammers: an ordinary van would stall there, so a nimble sports buggy takes the lead instead. It doesn't wait for signals from traffic controllers, blasting through potholes at breakneck speed without easing off the gas, even if half its wheels lose traction with the road for a split second.

This is precisely why the modern tunneling client is no longer just an "On/Off" button. Every location now comes paired with an acronym: VLESS, REALITY, Hysteria 2, TUIC. These aren't just marketing labels—they represent fundamentally different physics for delivering bytes through hostile network environments.

Hold on. If the difference between protocols to you boils down to the color of the app icon, you might as well close this tab. Go ahead and keep cycling through free configs at random until you get tired of it.

But if you are curious why TCP dies under packet loss, how TLS 1.3 ClientHello turns into a pass through censorship filters, and why obfuscation protocols are shifting to UDP—let's look under the hood of the transport stack.

Anatomy of the Triad: Who Handles What Under the Hood

To avoid getting tangled in terms, we need to divide the networking stack into three distinct layers: transport, encapsulation protocol, and camouflage method.

+-----------------------------------------------------------+
| Camouflage (Маскировка)    : REALITY, ShadowTLS           |
+-----------------------------------------------------------+
| Encapsulation (Инкапсуляция): VLESS, VMess, Trojan          |
+-----------------------------------------------------------+
| Transport (Транспорт)      : TCP, WebSocket, gRPC, QUIC   |
+-----------------------------------------------------------+

1. VLESS: Eliminating Cryptographic Ballast

Legacy protocols (such as VMess or Shadowsocks) carried double encryption. A packet was first encrypted with the protocol's own key and then wrapped in standard TLS. On low-end mobile processors and routers, this created a massive CPU load and added latency (RTT).

VLESS (Virtual Less) completely removed internal encryption. It is an ultra-lightweight Application Layer (Layer 7) protocol whose tasks boil down to just two things:

Client authentication via a 16-byte UUID without bulky handshakes.
Transparent forwarding of the raw TCP/UDP data stream.

VLESS completely delegates security and data encryption to the outer TLS tunnel. No double processing—meaning no parasitic CPU overhead.

2. REALITY: Stealing Someone Else's Digital Passport

A classic TLS proxy gives itself away because the server must have its own domain certificate. The censor performs Active Probing: knocking on a suspicious IP address with an ordinary browser request and checking what certificate the server returns. If it features a self-signed scrap or a domain that looks nothing like a real website, the node gets banned immediately.

REALITY changes the rules of the game. A VLESS-REALITY server does not have its own certificate.

The server acts as a reverse proxy for a completely foreign, clean resource (for example, a major CDN like [www.apple.com](https://www.apple.com) or cloudflare.com).
When DPI or an inspector sends a ClientHello request, the server forwards this traffic to a real third-party site and returns that company's genuine, valid certificate to the client.
A legitimate client authorizes using a hidden Auth Key field embedded inside the elliptic-curve public key (ECDH). If the key matches, the traffic goes into the private tunnel. If not, the server transparently proxies the attacker to the actual third-party site. To an external observer, the server is indistinguishable from the original web service.

3. Hysteria 2: Brute Force Based on Custom QUIC

While VLESS with REALITY are ideal for stable wired networks and strict allowlist-based censorship checks, TCP starts to choke over unstable radio links (the subway, a congested 4G sector, public Wi-Fi).

The problem with classic TCP lies in its Congestion Control mechanism and Head-of-Line Blocking delay. When even 2–3% of packets are lost in the airwaves, TCP cuts transmission speeds in half and stalls the entire stream while waiting for the lost segment to be retransmitted.

Hysteria 2 operates over UDP using a modified QUIC protocol:

Brutal Congestion Control: Hysteria does not drop its speed when packets are lost. It knows the designated channel bandwidth in advance and continues forcing data through at a fixed rate, aggressively compensating for losses.
Independent Streams: the loss of a single audio packet in a call does not delay the loading of a web page in a neighboring stream.
From the operator's perspective, this traffic looks precisely like a video call or streaming session via modern web platforms (WebRTC/QUIC).

Comparative Deployment Matrix

Use Case | Preferred Protocol | Why
Home wired internet / strict DPI: VLESS + REALITY (Vision) — Ideal mimicry of clean HTTPS traffic, absence of suspicious domain bindings.
Unstable mobile internet (LTE/5G/Subway): Hysteria 2 — Bypassing TCP limitations, maintaining maximum speed with up to 20–30% packet loss.
Cross-border corporate channels: TUIC v5 — Pure QUIC with minimal handshake latency (0-RTT) without aggressive channel stuffing.

Client Gateway Configuration Checklist

To squeeze the maximum out of each protocol and avoid triggering automated signature filters:

Enable Vision mode for VLESS:
Be sure to activate the flow: xtls-rprx-vision parameter. It analyzes packet sizes during the TLS handshake and introduces padding so that the length of the first data packet doesn't give away the characteristic profile of proxy protocols to DPI.
Choose the correct SNI for REALITY:
The camouflage domain (dest/serverNames) must support TLS 1.3 and the HTTP/2 protocol, and it must be physically close (in the same ASN or a neighboring data center) so that ping latency to the camouflage server and your tunnel doesn't cause statistical anomalies during passive analysis.
Limit bandwidth in the Hysteria config:
Never leave speed parameters blank. Explicitly configure the up_mbps and down_mbps limits on the client just below the actual capacity of the operator's radio channel, preventing the Brutal scheduler from overwhelming the base station's cell buffer (Bufferbloat).

The era of the universal tool is over. The network has become fragmented and aggressive, with filtering methods adapting to every physical layer. Understanding what tool is deployed under the hood of your tunnel is the difference between a sudden loss of connection at a critical moment and a stable, invisible-to-the-eye data transmission channel.