DPIBREAK(1)

NAME
dpibreak - simple and efficient DPI circumvention tool in Rust.

SYNOPSIS
dpibreak [OPTIONS]

DESCRIPTION
DPIBreak is a simple and efficient tool for circumventing Deep Packet Inspection (DPI), especially on HTTPS connections. It fragments the TCP packet carrying the TLS ClientHello so that certain DPI devices cannot extract the Server Name Indication (SNI) field and identify the destination site. It only applies to the first outbound segment that carries the TLS ClientHello; Other packets are not queued to userspace and pass through the kernel normally, unmodified. UDP/QUIC (HTTP/3) is not affected. This program is cross-platform and runs the same way on both Linux and Windows. No manual firewall configuration is required: starting the program enables it system-wide; stopping it disables it.

REQUIREMENTS

Linux
    Root privileges (or capabilities CAP_NET_ADMIN and CAP_NET_RAW) are required to install rules and attach to NFQUEUE. The nft command should be available. If it is not, dpibreak try to fallback iptables and ip6tables. Kernel support for nfnetlink_queue and xt_u32 (when nft is not available) is required. (these modules are typically auto-loaded)

Windows
    Administrator privilege is required to open the WinDivert driver; the program opens the driver automatically at startup.

OPTIONS

-D, --daemon
    Run as a background daemon. Logs are written to /tmp/dpibreak.log. If a daemon is already running, it will fail with "unable to lock pid file". To stop it, run kill `cat /tmp/dpibreak.pid` as root.

    On Windows, this option enters the service controller entry point. Example: sc create dpibreak binPath= "dpibreak.exe -D" start= auto; sc start dpibreak

--delay-ms <u64>
    Delay in milliseconds to apply between fragmented pieces of the ClientHello. Typical values are 0–1000; larger values may increase handshake latency. (Default: {{DEFAULT_DELAY_MS}})

--fake
    Enable fake ClientHello packet injection before sending each packet fragmented. TCP/IP header fields follow the original packet unless you override it using the --fake-* options described below. Packets are transmitted in an interleaved order: (fake 1), (orig 1), (fake 2), (orig 2), ...

--fake-ttl <u8>
    Override ttl (IPv4) / hop_limit (IPv6) of fake packet. Implicitly enables --fake. (Default: {{DEFAULT_FAKE_TTL}})

--fake-autottl
    Automatically infer the hop count (TTL/Hop Limit) to the destination by analyzing the SYN/ACK packet. It assumes the server's initial TTL is either 64, 128, or 255. The inferred value is used for fake packet transmission to ensure they reach the censor but not the destination. By default, it uses a delta of 1. If the hop count cannot be determined, it falls back to the value specified by --fake-ttl. Implicitly enables --fake.

--fake-badsum
    Corrupts the TCP checksum of fake packets. When enabled, fake packets cannot pass through most routers and will not behave as expected. It can be useful if your router/firewall provides an option to disable TCP checksum verification. Implicitly enables --fake.

--queue-num <u16>
    NFQUEUE number to attach to. The same queue number is used for IPv4 and IPv6. (Default: {{DEFAULT_QUEUE_NUM}})

--nft-command <string>
    Custom nftables command to be executed. (Default: {{DEFAULT_NFT_COMMAND}})

--log-level <debug|info|warning|error>
    Set the logging level (Default: {{DEFAULT_LOG_LEVEL}}). Aliases: warn -> warning, err -> error.

--no-splash
    Disable splash messages at startup.

-h, --help
    Show usage information and exit.

EXAMPLES

Run with default options:

    dpibreak

Run as daemon with fake feature:

    dpibreak -D --fake-autottl

Run with a 10 ms delay and verbose logging:

    dpibreak --delay-ms 10 --loglevel debug

Use a custom NFQUEUE on Linux:

    dpibreak --queue-num 3

Run with fake feature:

    dpibreak --fake-autottl

BUGS
Although the program works reliably in the author's region and ISP, different regions, ISPs, or organizations may deploy different DPI equipment. In such cases, there is a chance that dpibreak does not function as expected. If you encounter such issue, please report symptoms and, if possible, packet capture logs (e.g., collected with Wireshark) or hints such as cases where alternative tools like GoodByeDPI succeed with specific settings to the bug tracker listed below.

When sharing packet capture logs, please make sure they do not contain sensitive personal information (e.g., passwords or session cookies). It is usually enough to capture only the initial handshake packets showing the issue, rather than full sessions.

Any other problems not covered above are also appreciated. Report bugs at <https://github.com/dilluti0n/dpibreak/issues>.

SECURITY AND PRIVACY
The program does not store or transmit your traffic. Fragmentation is performed locally on the host; no external proxy or relay is used.

EXIT STATUS
Normally, dpibreak runs continuously until interrupted by the user (e.g. with Ctrl+c) or the system. In such cases it exits with status 0. Non-zero exit codes are returned if the program fails to start (for example, due to insufficient privileges, missing iptables/WinDivert, or invalid options).

SEE ALSO
nft(8), iptables(8), ip6tables(8), tcpdump(1), wireshark(1)

GoodByeDPI <https://github.com/ValdikSS/GoodbyeDPI>

AUTHOR
Written by Dilluti0n <hskimse1@gmail.com>.