Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
isofew authored Mar 25, 2017
1 parent 68bae37 commit 45b3c84
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ sudo ./sssniff.py
Finally, browse the web via your SS proxy. When the script detects more than 15 suspicious connections to/from one source, it will flag it to be a ShadowSocks server and print to the terminal.

### Method
ShadowSocks is famous for its randomness feature; however, the first packet of a connection is usually not expected to be random. Even in a TLS session, we expect to see some plaintext sections in the handshake stage. Therefore, one can detect ShadowSocks traffic by simply looking at the first few packets and calculating their entropy (as a measurement of randomness). Together with some minor adjustments, this method suffices to detect the current ShadowSocks protocol at a high precision.
ShadowSocks is famous for its randomness feature; however, the first packet of a connection is usually not expected to be random. Even in a TLS session, we expect to see some plaintext sections in the handshake stage. Therefore, one can detect ShadowSocks traffic by simply looking at the first few packets and calculating their entropy (as a measure of randomness). Together with some minor adjustments, this method suffices to detect the current ShadowSocks protocol at a high accuracy.

### TODO
* Develop a more general method to detect proxy traffic.
Expand Down

0 comments on commit 45b3c84

Please sign in to comment.