I wrapped my Socks5 traffic in TLS using Stunnel and the Stunnel server is listening on the port 443:tcp.

I can connect successfully to Stunnel server and exchange Socks5 traffic.

From the perspective of DPI (Deep packet inspection), is the traffic the same as regular HTTPS or they are different?

1 Answer 1


I assume that with "regular HTTPS" you mean surfing the web using a web browser. In this case multiple target sites are involved, thus DPI can observe that connections to many different hosts are done. With Socks5 over TLS there is only a single or a few connections and only the a single or few Socks5 endpoints - which is easy to distinguish from "regular HTTPS".

Additionally with "regular HTTPS" many DNS questions are responses can be observed. This can even be observed when DNS ober HTTPS is used, because of characteristic traffic patterns different from visiting normal web sites. With Socks5 instead DNS resolution is often done by the Socks5 endpoint and not by the client.

Additionally the TLS stack of the client might be fingerprinted and compared to what common browsers usually have - see JA3.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .