How Packet Fragmentation Defeats Deep Packet Inspection (DPI)

DPI hardware monitors initial TLS Client Hello packets to inspect SNI domain names. By splitting the TLS Client Hello handshake across multiple fragmented TCP packets (e.g. 1-3 bytes per fragment), the firewall cannot inspect the domain name in a single buffer, allowing the connection to pass through unhindered.

Recommended Fragment Parameters in WhiteVPN

  • Packets: 1-3 (splits the first 1 to 3 handshake packets)
  • Length: 4-16 bytes
  • Interval: 5-12 milliseconds

Step-by-Step Setup in WhiteVPN

  1. Open WhiteVPN and go to Settings → Advanced Connection Settings.
  2. Enable TLS Fragmentation (Fragment).
  3. Apply the recommended values above.
  4. Save and reconnect to your profile.