Category: Network / Transport Layer Residuals
1. Description
Even with TLS and HTTP spoofing, residual network signals persist because Obscura's own network stack is visible to the destination server. These signals cannot be fully normalized because they are properties of the container's OS and network path.
2. Vectors
2.1 TCP/IP Stack Fingerprint
Received SYN packet:
Window: 64240
TTL: 64
MSS: 1452
Options: MSS, SACK_PERM, TIMESTAMP, NOP, WINDOW
Window Scale: 10
DF: True
Container OS fingerprints:
| Container Base | Window | TTL | MSS | Options | JA4T-like |
|---|---|---|---|---|---|
| Alpine Linux | 29200-65535 | 64 | 1460 | M,S,T,N,W | 29200_2-4-8-1-3_1460_7 |
| Debian/Ubuntu | 29200-65535 | 64 | 1460 | M,S,T,N,W | 29200_2-4-8-1-3_1460_7 |
| Distroless | 29200-65535 | 64 | 1460 | M,S,T,N,W | Depends on Go/Rust runtime |
Entropy: ~4-6 bits
Mitigation: None at proxy level. Container's TCP stack is inherited.
2.2 Network Round-Trip Time (RTT)
RTT is measurable by the server:
Request sent: T1
Response received: T2
RTT = T2 - T1 // Including proxy processing time
- Real RTT varies by network path
- Proxy adds consistent latency (detectable as extra processing time)
- RTT variance over time creates a pattern
Entropy: ~5-8 bits (path + proxy latency signature)
Mitigation: Cannot eliminate, but can be partially hidden behind VPN/Tor.
2.3 Clock Skew
// Server-side calculation
const clientTimestamp = parseInt(getHeader('Date'))
const serverTime = Date.now()
const skew = serverTime - clientTimestamp
// Hardware clock drift is consistent
Each hardware clock drifts at a unique rate (parts-per-million). Over minutes of interaction, the drift becomes measurable.
Entropy: ~4-8 bits
Mitigation: Obscura can normalize HTTP Date headers, but TCP timestamp options in the SYN packet also reveal clock information.
2.4 HTTP/2 SETTINGS (If Unspoofed)
If Obscura does not implement custom HTTP/2 SETTINGS, the library defaults reveal the proxy:
| Proxy Library | Initial Window | Max Concurrent | Header Table Size |
|---|---|---|---|
| Go net/http | 6291456 | 250 | 4096 |
| Rust hyper | 65535 | 100 | 4096 |
| Node.js http2 | 65535 | 100 | 4096 |
| Envoy | 1048576 | 100 | 65536 |
Entropy: ~6-10 bits
Mitigation: Custom SETTINGS frame values matching the target browser profile.
2.5 MTU & Path Characteristics
- Path MTU affects TCP MSS
- TTL reveals approximate hop count to the user
- Router/ISP behavior creates unique patterns (NAT style)
Entropy: ~3-5 bits
Mitigation: Route through VPN/Tor to normalize.
2.6 HTTP/3 / QUIC (If Not Blocked)
QUIC transport parameters:
- Connection ID length and value
- Version negotiation
- Initial flow control limits
- TLS 1.3 handshake parameters on QUIC
Entropy: ~8-12 bits
Mitigation: Block UDP 443 to force TCP fallback.
3. Attacker's Strengths
| Strength | Explanation |
|---|---|
| Always present | Network signals are unavoidable in any TCP/IP connection |
| No JS required | These signals are observable at the transport layer |
| Hard to spoof | TCP/IP stack is OS-level, not application-level |
| Consistent | Network path changes infrequently |
| Cross-correlation | Used alongside HTTP/TLS signals |
4. Attacker's Weaknesses
| Weakness | Explanation |
|---|---|
| Low individual entropy | TCP/IP alone cannot identify a specific user |
| Shared container environment | Multiple users behind same container look identical |
| Only useful in aggregate | Needs combination with other signals |
| VPN/Tor normalizes | Routing through VPN/Tor eliminates network fingerprints |
5. Detection of Tampering
| Technique | How It Works |
|---|---|
| TLS vs TCP mismatch | Chrome TLS + Linux TCP stack = proxy |
| RTT vs claimed location | User claims US location but RTT suggests other continent |
| HTTP/2 vs browser claim | Go HTTP/2 SETTINGS with Chrome User-Agent |
| IP geolocation vs profile timezone | Mismatch between profile and actual network origin |
6. Mitigations for Obscura
6.1 What Obscura Can Do
| Mitigation | Effectiveness | Detectability | Implementation |
|---|---|---|---|
| TLS spoofing via utls | High | Low | Required for Obscura |
| HTTP/2 SETTINGS spoofing | Medium | Low | Custom SETTINGS values |
| Route through VPN/Tor upstream | High | Medium | User-configurable |
| Block UDP 443 (QUIC) | High | Low | iptables rule |
| Normalize HTTP Date headers | Low | Low | Header rewrite |
6.2 What Obscura Cannot Do
| Cannot | Why |
|---|---|
| Change TCP/IP stack of container | OS-level, inherited from container base image |
| Eliminate RTT | Physics of network distance |
| Change clock skew | Hardware clock drift is physical |
| Remove hop count information | TTL decrements are unavoidable |
6.3 Recommended Approach
1. TLS fingerprint spoofing via utls (critical top priority)
2. HTTP/2 SETTINGS mirroring (medium priority)
3. Block UDP 443 (prevent QUIC bypass)
4. Optional VPN/Tor upstream (normalizes all network signals)
5. Accept TCP/IP residuals (low individual entropy)
7. Research References
- FoxIO (2024). "JA4+ Suite: TLS, TCP, and QUIC Fingerprinting." FoxIO Blog.
- Zalewski, M. (2007). "p0f: Passive OS Fingerprinting." lcamtuf.coredump.cx/p0f.
- Beverly, R. (2004). "A Robust Classifier for Passive TCP/IP Fingerprinting." PAM 2004.
- Satori (2025). "Python rewrite of passive OS fingerprinting tool." GitHub: xnih/satori.