QManager Mark
QManager
41 articles
Universal (RM551E & RM520N)

DPI Traffic Engine & Video Masquerade

nfqws-based video streaming optimizer and TLS ClientHello masquerading to bypass carrier traffic shaping.

5 min read · Updated

DPI Traffic Engine & Video Masquerade

Many mobile networks perform Deep Packet Inspection (DPI) to throttle video streams (Netflix, YouTube, Twitch) down to 480p SD quality (~1.5 to 2.5 Mbps).

QManager RM551E Traffic engine (DPI) screen
RM551E: Bypass video throttling or masquerade HTTPS traffic, with a live packet graph.

What is Carrier DPI Shaping?#

Carrier middleboxes inspect the unencrypted Server Name Indication (SNI) in TLS ClientHello packets and the initial QUIC handshakes. When they see domains like googlevideo.com or nflxvideo.net, they apply a rate-limiting policer.

Video Optimizer (nfqws Engine)#

QManager integrates the high-performance nfqws (Netfilter Queue Web Scrambler) daemon:

  • TCP SNI Desynchronization: Splits the TLS ClientHello packet across TCP segment boundaries, confusing carrier DPI middleboxes while allowing end servers to reassemble the stream seamlessly.
  • QUIC / HTTP/3 Desync: Desynchronizes initial UDP QUIC packets.
  • Configurable CDN Hostlist: Target specific video CDNs without touching banking or gaming traffic.

Traffic Masquerade (SNI Spoofing)#

For aggressive carrier networks, QManager provides Traffic Masquerade:

  • Wraps outbound TCP connections in fake benign SNI headers.
  • Mutually exclusive with the Video Optimizer.
  • Toggle with one click in Network > DPI Engine.

Screens in QManager#

QManager RM520N Traffic Engine screen
RM520N: Traffic Engine runs the Video Optimizer or Full Bypass to get around carrier DPI throttling.