Ghost on the Wire: How Active Probing Exposes Masked Nodes via TCP Stack Anomalies and Echo Responses

Imagine walking up to a clandestine safe house hidden away in an ordinary residential district. It sports a fake public library sign on the door, a soft yellow glow radiates from the windows, and encyclopedias are neatly lined up on the windowsill. From the street, the picture is pristine: a quiet cultural institution raising no suspicions whatsoever.

Yet at midnight, a plainclothes patrolman walks silently up to the front door. He does not break the lock with his shoulder or shine a flashlight through the glass. Instead, he simply steps up to the door and knocks using a prearranged plumber's signal. He rattles the handle three times at one-and-a-half-second intervals, steps back, and whispers a maintenance code through the keyhole. An ordinary librarian would stay silent, call the police, or ask in a frightened voice, "Who's there?" But if a special electronic relay clicks from behind the door precisely fifty milliseconds later, the patrolman pulls out his radio. The cover is blown. The apartment is no library; it is an underground radio station that just gave itself away through an anomalous reaction to a provocative knock.

This is precisely how Active Probing operates within modern censorship systems and DPI complexes. The adversary no longer sits in ambush, passively sniffing traffic via port mirroring. As soon as your encrypted VLESS or REALITY tunnel establishes contact with a remote node, the censor initiates a series of synthetic test connections to your server. If the stack behaves even slightly differently from the declared white cover site, the IP address is sent straight to a permanent ban.

Warning: If your understanding of network security is limited to downloading a ready-made free config from a Telegram channel and tapping a big round Connect button, close this page. Go back to reading glossy reviews of paid VPNs.

But if you have tuned a Linux kernel via sysctl, analyzed TCP Window Size anomalies in Wireshark dumps, witnessed censors emulate corrupted TLS 1.3 ClientHello packets, and want to lock down your node against TSPU scanners for good, grab your soldering iron. Pure network engineering starts below.

The Mechanics of Active Probing: From Passive Sniffing to Direct Frontal Attacks

The era when DPI simply inspected unencrypted SNI (Server Name Indication) or triggered on OpenVPN/WireGuard header signatures is long gone. Modern TSPU complexes operate on a hybrid two-phase model:

[Client] ────────── (VLESS-REALITY Session) ──────────> [Server (Gateway)]
                            │
               [TSPU / Passive Sensor]
              (Detects long-lived session)
                            │ (Heuristic trigger fires)
                            ▼
               [Active Probe Cluster]
                            │
    ┌───────────────────────┴───────────────────────┐
    ▼                                               ▼
[Test 1: Replay Attack]                  [Test 2: Malformed Handshake]
(Replays raw ClientHello)                (Request with broken extensions)
    │                                               │
    ▼                                               ▼
[Compare node response against reference camouflage server (dest)]

Phase 1: Target Selection by the Passive Analyzer

The backbone sensor monitors the continuous data flow:

A TCP/443 connection to a foreign external IP address not belonging to major CDN pools is registered.

The ClientHello packet looks clean: it specifies a legitimate camouflage domain (such as gateway.icloud.com or a major financial portal).

However, the data volume, encrypted stream entropy, and session duration do not match typical web browsing behavior. A verification task for the target IP is instantly queued in the probe scheduler.

Phase 2: Probing Vectors

Within a couple of minutes, a series of specialized packets is hurled at the target server from a pool of addresses belonging to local operator nodes or rented scanners:

Handshake Replay Attack.
The probe sends an exact copy of the first ClientHello packet sent by a real client ten seconds prior to port 443. If the server runs a primitive proxy implementation without anti-replay protection, it will attempt to process the packet or drop the connection with a delay distinct from the behavior of a standard NGINX or Apache web server.
Malformed TLS Frames Probing.
The probe connects with a TLS 1.3 packet featuring a deliberately corrupted Extension Length field, non-existent Cipher Suites, or a stripped SNI header.

Real NGINX running on a legitimate server immediately returns a fatal TLS Alert: Decode Error (50) or Unrecognized Name (112) alert and sends a packet with the TCP FIN/ACK flag.

Custom or raw proxy daemons often silently close the socket via TCP RST or hang on a timeout (Keep-Alive Hang). The analyzer records this difference in timing and cutoff packet types with millisecond precision.

TCP/IP Stack Desynchronization (SYN-Packet Fingerprinting).
The probe sends a TCP SYN with a non-standard TCP Window Size, specific TCP SACK options, and an unusual MSS value. If the real camouflage site sits physically on a server running FreeBSD or a proprietary CDN router OS, while your proxy is deployed on a standard Ubuntu 24.04 kernel, the returning SYN-ACK packet gives away the spoofing: TTL values, window scaling, and TCP option ordering differ drastically.

Architectural Flaw: Why Standard REALITY Falls Short

REALITY was designed as an ideal shield: if an incoming connection lacks the correct authorization cryptographic key (Short ID / Public Key), the server redirects the raw byte stream to a real, legitimate white site (dest).

However, administrators frequently make three critical configuration mistakes:

Latency Gap.

Your VPS is rented in Frankfurt, but the dest address points to a company server physically located in California. When the TSPU probe knocks on your IP, the request travels to Frankfurt (e.g., 40 ms), your server forwards the request across the Atlantic to California and back (+140 ms), making the probe response time skyrocket to 180 ms. When the censor queries the real site directly, the response time is 100 ms. The algorithm flags an RTT anomaly, exposing the presence of a hidden proxy hop.

ALPN Chain Certificate Fingerprint Mismatch.

If the target camouflage domain supports h2 (HTTP/2) and h3 (QUIC), but your Xray core config enforces a restriction to http/1.1, the probe encounters a mismatch between the negotiated ALPN protocol and the declared capabilities of the white domain.

Port Leaks via Adjacent Service Scanning.

An administrator hides port 443 but leaves port 22 (SSH) open with the default OpenSSH_9.6p1 Ubuntu greeting banner. The TSPU scanner probes adjacent ports: if a standard Linux server is detected on the node, the probability that port 443 hosts a public Apple or Microsoft corporate portal drops to zero.

Engineering Defense Protocol: Total Node Lockdown

To reduce the odds of active probing to zero, your node must be indistinguishable from a reference web server at both the application layer (TLS) and the transport layer (Layer 4).

Synchronizing RTT and Location of the Target Camouflage Node (dest).

Select a camouflage address strictly within the same Autonomous System (ASN) or geographical region where your server physically resides:

Bash

# Check response time to the camouflage server from the host
# RTT should not exceed 3-5 ms
ping -c 4 target-server.com
traceroute target-server.com

The target site must support TLS 1.3 and HTTP/2, and return an identical set of Cipher Suites.

Kernel Parameter Paranoia: TCP Stack Camouflage.

Rewrite network stack parameters in /etc/sysctl.d/99-network-hardening.conf to throw off scanner profiling:

Ini, TOML

# Protection against SYN floods and incomplete handshake probing
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_max_syn_backlog = 4096

# Enable timestamps and disable source routing
net.ipv4.tcp_timestamps = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Ignore bogus ICMP errors
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Align TCP Window Scaling with major CDN profiles
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 16384 4194304

Apply directives without rebooting: sysctl --system.

Filtering Scanners via iptables and Whitelisting Network Ports.

Eliminate any visibility of third-party services. Move the standard SSH port to a closed range, and block access to it for all external addresses except your trusted subnet or management tunnel interface:

Bash

# Drop illegitimate packets with anomalous flag combinations
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# Protect against zero MSS window probing
iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP

# Allow SSH access exclusively from the internal wg0 VPN interface
iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP
iptables -A INPUT -i wg0 -p tcp --dport 22 -j ACCEPT

Mandatory Fallback Configuration in Xray/Sing-box.

In the streamSettings configuration block for REALITY, redirection directives must point to a genuinely existing host that completely transparently handles any malformed requests:

JSON

"realitySettings": {
  "show": false,
  "dest": "cdn-edge-node.net:443",
  "xver": 0,
  "serverNames": [
    "cdn-edge-node.net"
  ],
  "privateKey": "YOUR_PRIVATE_GENERATION_KEY",
  "shortIds": [
    "a1b2c3d4",
    "e5f60718"
  ]
}

The xver: 0 parameter prevents sending PROXY protocol headers if the target camouflage server does not expect them, preventing an instant session drop with a Bad Request error.

Fighting network censorship has long ceased to be a simple competition between encryption algorithms. Tunnel cryptography is flawless: mathematics cannot be broken on-the-fly via brute force. The war has shifted to the domain of micro-behaviors, timings, and signal propagation physics. Your server stays alive only as long as it reacts to the world in the exact same way as the giant white data center down the street. Show even a shred of individuality when responding to probe provocations, and your private corridor will collapse until your next IP address change.