Splits a TLS ClientHello across multiple TCP segments so
SNI-based DPI on Korean ISPs — KT, SKT, LGU+ — never sees the full hostname in one piece.
ISP DPI reads the plaintext SNI inside a TLS ClientHello before
encryption starts. Most DPI engines inspect one TCP segment at a time and
don't reassemble streams — so this tool intercepts the outbound packet,
splits the payload, and re-injects the pieces as separate segments. The
server reassembles them normally; the DPI sees an incomplete SNI and lets
the connection through.
Each segment alone carries neither a full SNI nor a complete TLS record header — the DPI's single-segment inspection has nothing to match.
| Mode | How | When to use |
|---|---|---|
| packet_size ★ | Split into N-byte chunks — more segments, stronger bypass | Default; works on most ISPs |
| offset | Parse SNI extension, split at hostname midpoint — 2 segments only | Lower CPU; try if packet_size is too slow |
uv if not already presentwinget install astral-sh.uvgit clone https://github.com/savvy773/dpi-bye.gitcd dpi-bye && .\dpi-bypass.ps1# Install uv if not already present winget install astral-sh.uv # Clone and launch (auto-elevates to Administrator) git clone https://github.com/savvy773/dpi-bye.git cd dpi-bye .\dpi-bypass.ps1
Press c to connect, q to quit — WinDivert releases on exit and internet restores automatically.
ClientHello only — all other traffic passes through unmodified.