Fundamentals
A glossary of VPN and network-filtering terms
The vocabulary in this area is dense and much of it is used loosely. These definitions are deliberately plain, and each stands on its own.
4 min readLast reviewed
A – E
- Active probing
- A filtering system connecting to a suspected endpoint itself, imitating a client, to confirm what is running there. It is effective because it does not depend on classifying your traffic correctly in real time.
- AEAD
- Authenticated Encryption with Associated Data. A cipher construction that provides both confidentiality and integrity in one step, so tampering is detected rather than silently decrypted into nonsense. Standard in every modern protocol.
- ALPN
- Application-Layer Protocol Negotiation. A TLS extension in which the client states which protocol it intends to speak inside the connection — for example HTTP/2. It is sent in the clear and is one more field that must be consistent with everything else.
- Bridge
- An entry point that is not published in any public list, distributed narrowly so that it is harder to enumerate and blocklist. The term comes from Tor but the idea is general.
- Certificate Transparency
- A public, append-only log of certificates issued by publicly trusted authorities. It exists so that mis-issued certificates can be spotted, and it has the side effect that any domain's certificate history is searchable by anyone.
- DNS-over-HTTPS (DoH)
- Name lookups carried inside an ordinary HTTPS connection, so the local network can neither read nor alter them. It does not hide the connection you then make to the address you looked up.
- Deep packet inspection (DPI)
- Examining the contents of network traffic rather than only its addressing information, in order to identify what protocol is in use and act on it.
- Encrypted Client Hello (ECH)
- A TLS mechanism that encrypts the sensitive part of the opening handshake, including the requested hostname, so that an observer sees only a generic public name.
F – O
- Fingerprinting
- Identifying software from the precise way it does something, rather than from what it says. In TLS this means the ordered set of cipher suites and extensions a client offers; see JA3 and JA4.
- Forged reset
- A TCP RST packet injected by an intermediary and spoofed to appear to come from the far end, terminating a connection that both endpoints believed was healthy.
- JA3 / JA4
- Schemes for hashing a TLS Client Hello into a short identifier for the client software. JA4 is the newer of the two and is more resistant to clients that deliberately shuffle their extension order.
- Kill switch
- A control that blocks ordinary network traffic whenever the tunnel is not established, so that a dropped tunnel cannot silently leak traffic onto the plain network.
- MTU
- Maximum Transmission Unit — the largest packet a link will carry. A tunnel adds headers, so the usable size shrinks; a mismatch typically shows as small requests succeeding while large pages hang.
- Multiplexing
- Carrying several logical streams inside one transport connection. It reduces the number of connections an observer sees, at the cost that one lost packet can stall every stream sharing the connection.
- No-logs
- A claim that a provider does not retain records of user activity. It is a policy statement about a specific list of data types, and it is only meaningful when that list is stated explicitly.
- Obfuscation
- Shaping the visible characteristics of a connection so it is not recognisable as a particular protocol. Distinct from encryption, which conceals content rather than identity.
P – Z
- Pluggable transport
- A modular layer that transforms traffic into a different shape before it is sent, so that the obfuscation strategy can be swapped without changing the protocol beneath it.
- REALITY
- A TLS approach in which the endpoint completes its handshake against a genuine third-party website and hands unauthenticated visitors through to that site, so that it holds no certificate of its own.
- Shadowsocks
- An encrypted proxy protocol designed to present no recognisable handshake, so that its traffic resembles random bytes rather than any identifiable protocol.
- SNI
- Server Name Indication. The hostname a client requests, sent in the clear at the start of a TLS handshake so that one address can serve many sites. It is the single most widely used input to filtering decisions.
- Split tunnelling
- Routing only some traffic through the tunnel and the rest directly. Useful for keeping local or latency-sensitive traffic off the tunnel, at the cost that the excluded traffic is visible to the local network.
- Throttling
- Deliberately limiting the rate of a flow rather than blocking it. Harder to attribute than a block, because it is not easily distinguished from congestion.
- VLESS
- A lightweight tunnelling protocol that performs no encryption of its own and adds minimal framing, relying on the transport beneath it — normally TLS — for confidentiality.
- VMess
- VLESS's predecessor, which carried its own encryption and a timestamp-based authentication scheme. Both added overhead and identifying characteristics.
- WireGuard
- A modern, deliberately minimal VPN protocol with excellent performance and a small codebase. It does not attempt to disguise itself, and its handshake is straightforward to fingerprint.
- XTLS Vision
- A mechanism that avoids re-encrypting payloads that are already TLS, removing both the processing cost of double encryption and the characteristic length pattern that nested TLS produces.