---
title: Proxy Protocol Comparison
url: https://doc.liz6.com/en/networking/07-proxy-protocol/03-proxy-protocol-comparison
locale: en
area: networking
tags:
- networking
- proxy-protocol
date: 2026-06-30
modified: 2026-07-16
description: The evolution of proxy protocols reflects the arms race between censorship and anti-censorship—after Shadowsocks’ AEAD encryption was identified by deep packet inspection, Trojan masqueraded as HTTPS, VLESS+REALITY masqueraded as real websites, and Hysteria2 eliminated TLS fingerprints over QUIC. Each generation makes proxy traffic harder to distinguish from normal traffic.
---

# Proxy Protocol Comparison

> The evolution of proxy protocols reflects the arms race between censorship and anti-censorship—after Shadowsocks’ AEAD encryption was identified by deep packet inspection, Trojan masqueraded as HTTPS, VLESS+REALITY masqueraded as real websites, and Hysteria2 eliminated TLS fingerprints over QUIC. Each generation makes proxy traffic harder to distinguish from normal traffic.

## Overview

The evolution of proxy protocols reflects the arms race between censorship and anti-censorship. Shadowsocks (2012) bypassed censorship using AEAD encryption but was later identified by deep packet inspection. Trojan (2019) masqueraded as standard HTTPS, making it difficult to distinguish. VLESS+REALITY (2023) masquerades as a real, existing website (microsoft.com), rendering active probing ineffective. Hysteria2 (2024) eliminates TLS fingerprints over QUIC, making it currently the hardest to detect.

## Protocol Stack Overview

| | Transport | Encryption | Obfuscation | Multiplexing | Anti-Censorship |
|---|---|---|---|---|---|
| HTTP CONNECT | TCP | None | None | No | Very Low |
| SOCKS5 | TCP/UDP | None | None | No | Very Low |
| Shadowsocks | TCP/UDP | AEAD (AES/ChaCha) | Optional obfs | mux (smux) | Low (AEAD can be identified) |
| VMess | TCP | AEAD | Optional obfs | mux | Medium |
| Trojan | TCP+TLS | TLS | Masquerades as HTTPS (CDN fallback) | mux | Medium-High (TLS handshake can be probed) |
| VLESS+REALITY | TCP+TLS | TLS+XTLS Vision | Masquerades as real website (microsoft.com) | mux (XUDP) | High (Active probing ineffective) |
| Hysteria2 | UDP (QUIC) | QUIC+TLS 1.3 | salamander obfs (anti-fingerprint) | QUIC native | Very High (No TLS fingerprint) |

## Key Design Points of Each Protocol

### Shadowsocks → AEAD Fingerprint Issue

Shadowsocks' AEAD cipher (AES-128-GCM) produces ciphertext with a fixed pattern during the handshake phase (salt + encrypted payload). The GFW can identify it through active probing (sending a Shadowsocks handshake → expecting a response of a specific size). After 2020, a large number of Shadowsocks servers were blocked.

### VMess → Custom Protocol

Uses a custom encryption protocol instead of standard TLS. The GFW identifies VMess traffic characteristics (non-TLS encrypted data streams) through deep packet inspection (DPI). It can be obfuscated by pairing with WebSocket + CDN relay.

### Trojan → TLS Masquerade

Trojan mimics HTTPS: the handshake phase uses standard TLS (SNI points to a normal website), so the GFW sees an "ordinary HTTPS connection." However, active probing (GFW sends ClientHello → Trojan server returns an abnormal Certificate) may lead to identification.

### VLESS+REALITY → Complete Masquerade

VLESS removes UUID verification, relying on TLS+XTLS Vision for encryption and flow control. REALITY masquerades the TLS handshake as accessing a **real, existing website** (e.g., www.microsoft.com):

<svg viewBox="0 0 720 360" xmlns="http://www.w3.org/2000/svg" font-family="-apple-system,'Source Han Sans CN','Microsoft YaHei',sans-serif" role="img" aria-label="REALITY masquerade handshake process: leveraging microsoft.com's real certificate to invalidate active probing">
  <defs><marker id="rah1" markerWidth="10" markerHeight="8" refX="8" refY="3" orient="auto"><path d="M0,0 L8,3 L0,6 Z" fill="#475569"/></marker></defs>
  <rect width="720" height="360" fill="#ffffff"/>
  <text x="360" y="28" text-anchor="middle" font-size="17" font-weight="700" fill="#1f2933">REALITY Masquerade Handshake: Leveraging microsoft.com's Real Certificate</text>

  <rect x="210" y="46" width="300" height="40" rx="8" fill="#4f46e5"/>
  <text x="360" y="70" text-anchor="middle" font-size="12" font-weight="700" fill="#ffffff">REALITY Server: Does not use its own SNI and certificate</text>
  <line x1="360" y1="86" x2="360" y2="102" stroke="#475569" stroke-width="1.6" marker-end="url(#rah1)"/>

  <rect x="160" y="104" width="400" height="50" rx="8" fill="#eef2ff" stroke="#c7d2fe"/>
  <text x="360" y="124" text-anchor="middle" font-size="12" font-weight="700" fill="#3730a3">Client sends TLS ClientHello to REALITY Server</text>
  <text x="360" y="142" text-anchor="middle" font-size="11" fill="#4f46e5">SNI = "www.microsoft.com"</text>
  <line x1="360" y1="154" x2="360" y2="170" stroke="#475569" stroke-width="1.6" marker-end="url(#rah1)"/>

  <rect x="106" y="172" width="250" height="56" rx="8" fill="#ffedd5"/>
  <text x="231" y="192" text-anchor="middle" font-size="12" font-weight="700" fill="#9a3412">Steal microsoft.com's Certificate</text>
  <text x="231" y="209" text-anchor="middle" font-size="11" fill="#c2410c">and ServerHello? (Real-time forwarding?)</text>
  <line x1="356" y1="200" x2="386" y2="200" stroke="#475569" stroke-width="1.6" marker-end="url(#rah1)"/>
  <rect x="390" y="172" width="250" height="56" rx="8" fill="#f0fdfa" stroke="#99f6e4"/>
  <text x="515" y="192" text-anchor="middle" font-size="12" font-weight="700" fill="#115e59">No! The REALITY Server holds</text>
  <text x="515" y="209" text-anchor="middle" font-size="11" fill="#0f766e">microsoft.com's actual certificate (obtained via active filing)</text>

  <line x1="515" y1="228" x2="515" y2="242" stroke="#475569" stroke-width="1.6"/>
  <line x1="515" y1="242" x2="360" y2="242" stroke="#475569" stroke-width="1.6"/>
  <line x1="360" y1="242" x2="360" y2="256" stroke="#475569" stroke-width="1.6" marker-end="url(#rah1)"/>

  <rect x="140" y="258" width="440" height="50" rx="8" fill="#ccfbf1"/>
  <text x="360" y="278" text-anchor="middle" font-size="12" font-weight="700" fill="#115e59">GFW Active Probe: Connects to REALITY's IP</text>
  <text x="360" y="296" text-anchor="middle" font-size="11" fill="#0f766e">Sees microsoft.com's standard TLS response</text>
  <line x1="360" y1="308" x2="360" y2="322" stroke="#475569" stroke-width="1.6" marker-end="url(#rah1)"/>

  <rect x="90" y="324" width="540" height="30" rx="7" fill="#dcfce7"/>
  <text x="360" y="344" text-anchor="middle" font-size="12" font-weight="600" fill="#166534">Indistinguishable from directly connecting to microsoft.com → Active probing fails</text>
</svg>

### Hysteria2 → Fingerprint-less QUIC

QUIC itself has no identifiable TLS fingerprint (unlike the fixed byte pattern of TCP+TLS). Hysteria2 adds salamander obfs to obfuscate the QUIC packet headers → does not match the QUIC standard → cannot be identified by a QUIC detector.

## References

- **REALITY**: github.com/XTLS/REALITY
- **Hysteria2**: v2.hysteria.network/docs
- **mihomo**: wiki.metacubex.one/config/proxies

*Keywords: Shadowsocks, VMess, Trojan, VLESS, REALITY, Hysteria2, AEAD, obfs, salamander, QUIC fingerprint*