IPv4/IPv6 TCP/TLS Fingerprint & Proxy Leaks

syn

mod: "syn"
cli: "127.0.0.1/48424"
srv: "127.0.0.1/8080"
subj: "cli"
os:  "???"
dist: ?
hl/ttl start: v6=? v4=?
params: "none"
raw_sig: "n/a"

mtu

mod: "mtu"
raw_mtu: 65535
client_from_mss: 0

uptime

mod: "uptime"
uptime: "unknown"
raw_freq:      "0.00 Hz"
method:        "(empty)"
raw_freq_flow: "0.00 Hz" (class: )
raw_freq_ip:   "0.00 Hz" (class: )
flow_jitter:   "0.00"
flow_samples:  0

tcp_info

mod: tcp_info
advmss: 65483
mss: 32768
rcvmss: 536
rtt: 0.034
rtt_var: 0.017
wscale: n/a
cwnd: 10
rcv_space: 65483
pmtu: 65535

http proxy leaks

{
  "X-Forwarded-For": "216.73.216.163",
  "X-Forwarded-Proto": "https",
  "X-Real-IP": "216.73.216.163",
  "forwarded_rfc7239": false,
  "Accept-Encoding": "gzip, br, zstd, deflate"
}

tls (https)

enabled: false
ja3: (empty)
ja3_md5: (empty)
sni: (empty)
alpn: []
note: Use https://[IPv6-or-IPv4]:8443 to get JA3

risk

score: 30
flags: proxy_headers_present,rcvmss_536_default
advice:
- терминируй X-Forwarded-*, Via, X-Real-IP до приложения
- добавь 150–300 ms задержки перед чтением TCP_INFO

raw JSON

{
  "syn": {
    "mod": "syn",
    "cli": "127.0.0.1/48424",
    "srv": "127.0.0.1/8080",
    "subj": "cli",
    "os": "???",
    "params": "none",
    "raw_sig": "n/a",
    "raw": {
      "ip_ver": 0,
      "time": "0001-01-01T00:00:00Z",
      "dscp": 0,
      "ecn": 0,
      "ecn_cap": false,
      "sack_ok": false,
      "options": null,
      "mptcp": false,
      "tfo": false
    }
  },
  "mtu": {
    "mod": "mtu",
    "cli": "127.0.0.1/48424",
    "srv": "127.0.0.1/8080",
    "subj": "cli",
    "link": "???",
    "raw_mtu": 65535,
    "client_from_mss": 0
  },
  "uptime": {
    "mod": "uptime",
    "cli": "127.0.0.1/48424",
    "srv": "127.0.0.1/8080",
    "subj": "cli",
    "uptime": "unknown",
    "raw_freq": 0
  },
  "tcp_info": {
    "mod": "tcp_info",
    "info": {
      "advmss": 65483,
      "mss": 32768,
      "rcvmss": 536,
      "rtt": 0.034,
      "rtt_var": 0.017,
      "wscale": "n/a",
      "pmtu": 65535,
      "snd_cwnd": 10,
      "rcv_space": 65483
    }
  },
  "http": {
    "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
    "protocol": "HTTP/1.1",
    "proxy_headers": {
      "X-Forwarded-For": "216.73.216.163",
      "X-Forwarded-Proto": "https",
      "X-Real-IP": "216.73.216.163",
      "forwarded_rfc7239": false,
      "Accept-Encoding": "gzip, br, zstd, deflate"
    }
  },
  "tls": {
    "enabled": false,
    "note": "Use https://[IPv6-or-IPv4]:8443 to get JA3"
  },
  "risk": {
    "score": 30,
    "flags": [
      "proxy_headers_present",
      "rcvmss_536_default"
    ],
    "advice": [
      "терминируй X-Forwarded-*, Via, X-Real-IP до приложения",
      "добавь 150–300 ms задержки перед чтением TCP_INFO"
    ]
  },
  "meta": {
    "iface": "eth0",
    "generated_at": "2026-01-01T07:16:22Z",
    "ipv6_ok": false
  }
}

TS-based uptime can be masked on modern OS.

pretty report • headers