Engineering & Legal Research Notice: This publication is prepared by the PROSTO24 Systems Engineering Desk strictly for academic protocol analysis, enterprise network security administration (hardening site-to-site and remote corporate tunnels against MITM and active probing), and NGFW/DPI telemetry auditing. It contains zero promotion or advertising of commercial VPN services and is intended solely for lawful corporate infrastructure protection.
In enterprise cybersecurity and network engineering, understanding how Deep Packet Inspection (DPI) engines and Next-Generation Firewalls (NGFW) process segmented, fragmented, and out-of-order TCP/IP packets is critical for designing resilient intrusion detection systems. Open-source network stack research utilities—such as Zapret (nfqws / tpws) on Linux and the userspace TCP/TLS segment manipulator ByeDPI (ciadpi / byebyedpi)—expose the architectural differences between stateless/inline middleboxes and the end-host TCP stack (RFC 9293). Here is our architectural breakdown from a network engineering and Blue Team hardening perspective.
Executive Summary (TL;DR)
- Not VPNs or External Tunnels: Utilities like
zapretandByeDPIdo not encrypt traffic, do not alter client IP addresses, and do not route traffic through remote proxy servers—they operate purely on local TCP/TLS segment framing. - Middlebox vs. End-Host Asymmetry: High-speed transit sensors inspect millions of concurrent flows under strict per-flow RAM budgets, whereas the destination server allocates a full kernel socket reassembly buffer.
- TCP Segmentation & TLS Record Splitting (
split,disorder,tlsrec): Splitting aTLS ClientHelloacross multiple RFC-compliant TCP segments or multiple TLS Handshake records tests whether an inline sensor performs full stateful stream and record reassembly. - Blue Team NGFW Hardening: Enterprise IDS/IPS deployments (Suricata 7+, Zeek, Palo Alto, UserGate) must enforce TCP checksum validation, TTL normalization, and multi-record TLS reassembly.
1. Passive vs. Inline DPI & NGFW Architectures
| Architecture Metric | Passive Sensor (TAP / Optical Splitter / SPAN) | Inline Enterprise NGFW / IPS |
|---|---|---|
| Physical Deployment | Out-of-band copy of traffic via optical splitter or mirror port | In-line bridge; every packet traverses the firewall NICs |
| Enforcement Mechanism | Injects spoofed TCP RST or redirect packets faster than the origin server |
Directly drops (DROP), normalizes, or buffers packets in transit |
| Out-of-Order Reassembly | Constrained by memory across 100GbE+ links | Full stateful reassembly buffer per corporate flow |
Inside the Real ByeByeDPI Application Interface (Local Packet Segmentation)
The four real application screens of ByeByeDPI (the Android frontend for the ciadpi C daemon) illustrate how userspace TCP/TLS segment manipulation operates locally without any external proxy servers:
- 1. Main Status Screen (
Connected (VPN) — 127.0.0.1:1080): Shows the active local loopback listener on127.0.0.1:1080, the activeciadpisegmentation string (-d1 -d3+s -s6+s ... -r1+s -As), and quick navigation cards (Editor,Settings,Strategy Finder). - 2. Command-Line Arguments Editor (
Аргументы командной строки): Allows engineers to toggle direct CLI flags forciadpi(multi-offset TCP split-s, out-of-order disorder-d, TLS Record splitting-r1+s, and auto-triggers-At/-As) and manage saved profiles under the Strategy List. - 3. Automated Strategy Benchmark (
Подбор стратегий — 28/33): Sequentially tests candidate TCP/TLS segmentation profiles and ranks each strategy by handshake completion rate (e.g.,90% — 29/32with a one-tapAPPLYbutton). - 4. General Settings (
Настройки → Общие): Controls operating mode (localVPNloopback vs. pureSOCKS5 Proxyon127.0.0.1:1080), customDNSresolver,IPv6support, and per-app routing filters.
2. Architectural Breakdown of Zapret (nfqws / tpws) and ByeDPI (ciadpi)
- Kernel-Queue Packet Manipulation (
nfqws): Hooks into the Linux kernel Netfilter queue (NFQUEUE) to test L4 TCP segmentation (split2,multisplit), out-of-order sequence transmission (disorder2), and TCP state machine desynchronization checks (checksum validation, TTL decay, RFC 2385 TCP MD5 options). - Userspace Socket & TLS Record Manipulation (
tpws&ByeDPI): Operates entirely in userspace via standard POSIX socket calls withTCP_NODELAY. Crucially, the--tlsrecmode splits the initial handshake at the TLS Record layer (producing two valid0x16records divided inside theSNIextension), testing whether L7 parsers reassemble fragmented TLS records after TCP stream reassembly.
PROSTO24 Engineering Verdict: Studying packet segmentation tools like Zapret and ByeDPI is essential for enterprise network architects and SOC engineers: it underscores why corporate NGFW and Suricata IDS deployments must enforce strict stateful TCP stream normalization, checksum verification, and multi-record TLS handshake assembly.
Frequently Asked Questions (FAQ)
Why do web servers accept a TLS ClientHello split across multiple TCP segments?
Because TCP (RFC 9293) is a stream-oriented protocol. The operating system kernel reassembles incoming segments by sequence number (SEQ) into a contiguous byte stream before passing it to the TLS library.
How should enterprise NGFWs be configured to prevent evasion via TCP segmentation?
Enable strict inline stream normalization, enforce checksum-validation: yes, normalize IP TTL values, and configure deep out-of-order TCP and multi-record TLS reassembly buffers.
All 5 Parts of the PROSTO24 Network Protocols & DPI Engineering Research Series (2026)
- AmneziaWG 3.1 Protocol & Amnezia 5.0.1.5 Architecture Research: WireGuard Header Randomization and Enterprise Tunnel Protection Against DPI Fingerprinting
- CSQTT Architecture Research (Rust / TURN / RTP): Multi-Stream Traffic Encapsulation in WebRTC Media Relays and Network Dispatcher Analysis
- VLESS Protocol & XTLS Reality Architecture: Cryptographic Analysis of TLS 1.3 Handshake, Active Probing Defense, and Zero-Overhead Vision Flow
- Comparative Analysis of Modern Network Transport Protocols (2026): Hysteria 2 (QUIC), TUIC v5, ShadowTLS v3, WireGuard, and OpenVPN DCO in Enterprise Networks
- DPI Traffic Analysis Technologies & TCP/TLS Packet Fragmentation Optimization: Architectural Breakdown of Zapret (nfqws) and ByeDPI from a Network Engineering Perspective (Current Article)
This asymmetry highlights a fundamental flaw in enterprise edge security. Stateless middlebox heuristics fail because line-rate ASIC pipelines prioritize throughput over full TCP stream reassembly. Without hardware-accelerated reassembly buffers, NGFWs will continue to suffer evasion against basic RFC-compliant segmentation.
This asymmetry highlights a fundamental bottleneck in multi-gigabit transit inspection. Because carrier-grade DPI engines must bound their state tables to mitigate SYN floods, enforcing strict stream reassembly without degrading throughput remains a severe hardware-cost trade-off across 100GbE enterprise fabrics.