TLS · SNI Evasion — Schematic

DPI Fragment Bypass

Splits a TLS ClientHello across multiple TCP segments so SNI-based DPI on Korean ISPs — KT, SKT, LGU+ — never sees the full hostname in one piece.

Engine
WinDivert + pydivert
Platform
Windows 10 / 11
Privilege
Administrator
Author
@savvy773
License
MIT

Detail — Fragmentation

ISP DPI reads the plaintext SNI inside a TLS ClientHello before encryption starts. Most DPI engines inspect one TCP segment at a time and don't reassemble streams — so this tool intercepts the outbound packet, splits the payload, and re-injects the pieces as separate segments. The server reassembles them normally; the DPI sees an incomplete SNI and lets the connection through.

CLIENT ClientHello SNI=blocked.site SEG A no SNI SEG B no TLS header ISP DPI no match SERVER reassembled ✓

Each segment alone carries neither a full SNI nor a complete TLS record header — the DPI's single-segment inspection has nothing to match.

Table — Fragment Modes

ModeHowWhen to use
packet_size ★Split into N-byte chunks — more segments, stronger bypassDefault; works on most ISPs
offsetParse SNI extension, split at hostname midpoint — 2 segments onlyLower CPU; try if packet_size is too slow

Procedure — Quick Start

  1. Install uv if not already present
    winget install astral-sh.uv
  2. Clone the repository
    git clone https://github.com/savvy773/dpi-bye.git
  3. Launch — auto-elevates to Administrator
    cd dpi-bye && .\dpi-bypass.ps1
# Install uv if not already present
winget install astral-sh.uv

# Clone and launch (auto-elevates to Administrator)
git clone https://github.com/savvy773/dpi-bye.git
cd dpi-bye
.\dpi-bypass.ps1

Press c to connect, q to quit — WinDivert releases on exit and internet restores automatically.

General Notes

  • Intercepts outbound TCP 443 ClientHello only — all other traffic passes through unmodified.
  • QUIC / HTTP3 (UDP 443) is not handled.
  • WinDivert kernel driver loads on Connect and unloads on Disconnect/Quit — no permanent installation.
  • For personal and educational use. Verify compliance with your ISP's terms of service.