Aroma: Every TCP Proxy Is Detectable with RTT Fingerprinting
Get picks like this daily. Today's launch numbers, the top launches, AI and tech news, and a daily opportunity pick, straight to your inbox.
Want to reach these readers? Sponsor an issue.
TL;DR explanation (go to https://github.com/Sakura-sx/Aroma?tab=readme-ov-file#tldr-e... if you want the formatted version)This is done by measuring the minimum TCP RTT (client.socket.tcpi_min_rtt) seen and the smoothed TCP RTT (client.socket.tcpi_rtt). I am getting this data by using Fastly Custom VCL, they get this data from the Linux kernel (struct tcp_info -> tcpi_min_rtt and tcpi_rtt). I am using Fastly for the Demo since they have PoPs all around the world and they expose TCP socket data to me.The score is calculated by doing tcpi_min_rtt/tcpi_rtt. It's simple but it's what worked best for this with the data Fastly gives me. Based on my testing, 1-0.7 is normal, 0.7-0.3 is normal if the connection is somewhat unstable (WiFi, mobile data, satellite...), 0.3-0.1 is low and may be a proxy, anything lower than 0.1 is flagged as TCP proxy by the current code.
HN · launched Dec 25, 2025 · 86 upvotes (top 12%) · 1 view
Niche: network monitoring and diagnostics tools · 193 launches, 11 in the last 7 days ▼ -35% · Explore this niche →
Category and tags
- Security
- Observability & eval
- Developer
- Not AI
- Hobby / open-source project
Visit website ↗ Source listing ↗
More like this: all 193 launches in network monitoring and diagnostics tools →
Could you build this?
Partial A simple demo script using CDN edge logs or kernel socket metrics is accessible, but building a robust proxy-detection system via TCP RTT fingerprinting requires deep networking research and edge compute infra.
What it would actually take: Built on edge serverless platforms like Fastly VCL or eBPF in the Linux kernel to sample raw socket metrics (`tcp_info` struct, `tcpi_min_rtt`, and smoothed RTT). The difficult piece is developing the statistical heuristics and timing analysis algorithms to reliably distinguish reverse proxies and VPN hops from natural jitter and asymmetric routing without false positives. Requires deep TCP/IP networking expertise and edge observability infrastructure.
Discussion
20 comments analyzed.
Competitors mentioned: XVCL for VCL code writing, sshuttle transparent proxy, CONNECT proxy, SOCKS proxy, BrighData residential proxies
Concerns raised: Detection can be bypassed with VPNs or protocol changes, High false positive rates when blocking legitimate customers, Doesn't work against RDP/VM-based proxies, TCP RTT fingerprinting defeated by quick-ack or QUIC, Scrapers can use 100k residential IPs vs VPN's 5 egress IPs
Feature requests: Support for QUIC/H3 protocol detection, MASQUE proxying support, Fingerprinting detection for tunnels through QUIC, Layer 3 eBPF-based proxy detection, WebSocket RTT comparison detection
Competitors
Other products that read as similar to this one : 247 launches clear the similarity bar, closest 8 shown.
Attention rank: #19 of 248 (itself plus its competitors, highest first, normalized so YC and Product Hunt are compared fairly).
Launched 57 days after the earliest competitor.
- SMTP Tunnel · hn · 2026-01-07 · 140 upvotes · similarity 0.53
- Rich Proxies · ph · 2026-10-20 · 1 upvotes · similarity 0.45
- Check if your IP has appeared in a residential proxy network · hn · 2026-09-15 · 75 upvotes · similarity 0.45
- Mtproto.zig · hn · 2026-04-03 · 24 upvotes · similarity 0.45
- Synthient · ph · 2026-10-02 · 1 upvotes · similarity 0.44
- 12CE Proxy Lens · ph · 2026-09-16 · 1 upvotes · similarity 0.43
- Port Sentinel · ph · 2026-09-14 · 1 upvotes · similarity 0.42
- pulse-proxy-checker · github · 2026-10-12 · 64 upvotes · similarity 0.42
The niche, labels, vibe code rating and competitor comparison on this page are analysis by Nicheloom. If you use them, please credit nicheloom.com. How you may use our data.