chatnest.ir/SNISPF
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

change

Browse Source
This commit is contained in:
nouri_a
2026-04-16 14:15:33 +03:30
parent 1bad6394d1
commit d3486c0458
4 changed files with 36 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+18 -18
View File
@@ -143,7 +143,7 @@ docker run --rm -p 40443:40443 snispf
The simplest way to start -- using the default settings:
```bash
snispf -l 0.0.0.0:40443 -c 188.114.98.0:443 -s auth.vercel.com
snispf -l 0.0.0.0:40443 -c 5.10.249.0:443 -s vercel.com
```
What each part means:
@@ -151,8 +151,8 @@ What each part means:
| Flag | What it does | Example value |
|---|---|---|
| `-l` | The local address and port SNISPF listens on | `0.0.0.0:40443` (all interfaces, port 40443) |
| `-c` | The real server IP and port to forward traffic to | `188.114.98.0:443` (a Cloudflare IP) |
| `-s` | The fake website name to show the firewall | `auth.vercel.com` (an allowed domain) |
| `-c` | The real server IP and port to forward traffic to | `5.10.249.0:443` (a Cloudflare IP) |
| `-s` | The fake website name to show the firewall | `vercel.com` (an allowed domain) |
> **Tip:** If you're not sure what IP or fake SNI to use, the defaults above work for many Cloudflare-based setups.
@@ -191,13 +191,13 @@ snispf --config config.json
```bash
# Basic usage
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com
# Use the strongest bypass method
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined
snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
# See verbose debug output
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -v
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -v
# Check what your system supports
snispf --info
@@ -211,9 +211,9 @@ Here's what each field in `config.json` does:
{
"LISTEN_HOST": "0.0.0.0",
"LISTEN_PORT": 40443,
"CONNECT_IP": "188.114.98.0",
"CONNECT_IP": "5.10.249.0",
"CONNECT_PORT": 443,
"FAKE_SNI": "auth.vercel.com",
"FAKE_SNI": "vercel.com",
"BYPASS_METHOD": "fragment",
"FRAGMENT_STRATEGY": "sni_split",
"FRAGMENT_DELAY": 0.1,
@@ -226,9 +226,9 @@ Here's what each field in `config.json` does:
|---|---|---|
| `LISTEN_HOST` | IP address to listen on. `0.0.0.0` means all network interfaces. | `0.0.0.0` |
| `LISTEN_PORT` | Port number to listen on locally. | `40443` |
| `CONNECT_IP` | The real server's IP address to forward traffic to. | `188.114.98.0` |
| `CONNECT_IP` | The real server's IP address to forward traffic to. | `5.10.249.0` |
| `CONNECT_PORT` | The real server's port. | `443` |
| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `auth.vercel.com` |
| `FAKE_SNI` | A website name that is NOT blocked in your region. The firewall will see this instead of the real one. | `vercel.com` |
| `BYPASS_METHOD` | Which bypass technique to use: `fragment`, `fake_sni`, or `combined`. | `fragment` |
| `FRAGMENT_STRATEGY` | How to split the hello message: `sni_split`, `half`, `multi`, or `tls_record_frag`. | `sni_split` |
| `FRAGMENT_DELAY` | How long to wait between sending fragments (in seconds). | `0.1` |
@@ -308,10 +308,10 @@ Uses both methods at the same time: injects a fake hello (if root is available),
**Without root:** Fragments only (the fake injection is skipped since it can't be done safely without raw sockets).
```bash
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined
snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
# On Linux, run with sudo for the full seq_id trick:
sudo snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com -m combined
sudo snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com -m combined
```
---
@@ -330,7 +330,7 @@ These control *how* the hello message gets split up (used by `fragment` and `com
Example:
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi
```
---
@@ -373,22 +373,22 @@ Try these steps in order:
1. **Switch bypass method:** `fragment` -> `combined` -> `fake_sni`
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined
```
2. **Try different fragment strategies:** `sni_split` -> `multi` -> `tls_record_frag`
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-strategy multi
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-strategy multi
```
3. **Increase the delay between fragments:**
```bash
snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com --fragment-delay 0.2
snispf -l :40443 -c 5.10.249.0:443 -s vercel.com --fragment-delay 0.2
```
4. **Try a different fake SNI.** Pick a major website that's not blocked in your area:
```bash
snispf -l :40443 -c 188.114.98.0:443 -s dl.google.com
snispf -l :40443 -c 5.10.249.0:443 -s dl.google.com
```
5. **Double-check the target IP and port.** Make sure `CONNECT_IP` actually points to the server you want.
@@ -407,7 +407,7 @@ On Linux, consider using `combined` or `fake_sni` with `sudo` instead. The raw i
On Linux, run as root. This enables raw packet injection which is the same technique as the original [patterniha tool](https://github.com/patterniha/SNI-Spoofing):
```bash
sudo snispf -l :40443 -c 188.114.98.0:443 -s auth.vercel.com -m combined
sudo snispf -l :40443 -c 5.10.249.0:443 -s vercel.com -m combined
```
### How do I check what my system supports?