SpoofDPI: a userspace proxy built to make packet inspection misread you

What the tool claims to neutralise, and for whom

The repository describes SpoofDPI as a simple proxy tool, mainly designed to neutralize the Deep Packet Inspection techniques that power many internet censorship systems. That phrasing is precise in a way most tools in this space are not. It is not claiming to defeat a specific government, and it is not claiming to make traffic invisible. It targets the class of systems that inspect live packets and react when they can match a signature.

The audience is implied by what the project refuses to support. A caution block near the top of the README states that SpoofDPI is not available on iOS or Android, and that official binaries are only provided through GitHub and official package managers, with an explicit warning not to download it elsewhere because such copies may contain malware. That is a narrow, honest position: a desktop tool, distributed the way desktop tools are distributed.

It is worth noticing how firmly the mobile line is drawn. The project states plainly that it is not available on iOS or Android. If you are reading about a mobile variant, you are reading about a third party fork, not about this code.

What the dependencies reveal

The `go.mod` file lists libraries used by the project, though their presence alone does not establish how each is used at runtime. `github.com/google/gopacket` handles raw packet construction and parsing, `github.com/kentik/patricia` provides a radix tree, which is the classic structure for matching many destinations quickly, and `github.com/miekg/dns` is a full DNS library rather than a stub resolver. `gvisor.dev/gvisor` brings a userspace network stack, and `golang.zx2c4.com/wireguard` appears alongside it.

A packet library and a userspace networking library provide building blocks; tracing the code and testing a particular configuration are necessary to establish how a connection is handled.

The user interface stack is `charmbracelet/bubbletea`, `bubbles` and `lipgloss`, which means there is an interactive terminal interface, and `urfave/cli/v3` underneath it for flag parsing. `BurntSushi/toml` handles configuration and `rs/zerolog` handles logs. `golang.org/x/sys` and `golang.org/x/net` are the usual low level building blocks. The module targets Go 1.26.2.

Building it: static binary, scratch container, no runtime

The `Dockerfile` is seven lines and gives the whole build story. It installs the command from the module path with the `timetzdata` build tag and stripped, static linking flags, then copies the result into a `scratch` image that contains nothing but the CA certificate bundle and the binary.

FROM golang:alpine AS builder
WORKDIR /go
RUN go install -ldflags '-w -s -extldflags "-static"' -tags timetzdata github.com/xvzc/spoofdpi/cmd/spoofdpi@latest

FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /go/bin/spoofdpi /
ENTRYPOINT ["/spoofdpi"]

A scratch image matters more here than it would for an ordinary service. There is no shell, no package manager and no libc in the final filesystem, so the attack surface of the thing you are running to reach the open internet is close to a single binary. The CA bundle copy is deliberate: without it, TLS verification would fail inside the container.

For local development the `Makefile` targets are more conventional. `make build` compiles `./cmd/...`, and the test target runs with the race detector and a custom build tag.

test:
	go test $(ARGS) -race -tags network ./... -v

lint:
	golangci-lint run

fmt-check:
	golangci-lint fmt --diff

The `network` build tag on the test run tells you the suite opens real sockets, which is reasonable for a tool whose entire job is packet timing and cannot be meaningfully checked against a recorded fixture.

Configuration bugs from May 2026 and what they reveal

The most recent releases are v1.5.3 (2026-05-18), v1.5.4 (2026-09-30) and v1.5.5 (2026-10-16).

Distribution, Nix packaging and the warning the project insists on

The README carries a Repology badge tracking which distributions package SpoofDPI, which is the honest way to answer the constant `SpoofDPI download` question. The tree shows why a project like this is easy to package and also easy to impersonate: there is a `Makefile`, a `Dockerfile`, a `.goreleaser.yaml`, an `install.sh`, `flake.nix` and `devenv.nix`.

The Nix files matter more than the average project of this size. The flake lock file pins Nix inputs; reproducibility also depends on the build and other dependencies.

The `install.sh` at the repository root is the one thing that deserves suspicion from a newcomer, and the README's caution block is aimed at exactly this. Fetching and running a shell script to obtain a tool you intend to route your traffic through is a bad trade, and the project says so by directing you to GitHub releases and official package managers instead. There is no contradiction here: the repository hosts the installer for convenience, and simultaneously warns you against unverified copies from elsewhere.

One more repository detail is worth a mention for anyone auditing it. The `Makefile` has a `claude` target that symlinks `.agents/rules` and `.agents/AGENTS.md` into a `.claude` directory, which is why `.agents/` appears in the tree. It has no bearing on runtime behaviour.

Where SpoofDPI stops and other approaches begin

The README credits two projects as inspiration, Green Tunnel and GoodbyeDPI. SpoofDPI's own differentiation is modest and mostly in packaging: a TOML configuration file rather than a bag of flags, an interactive terminal interface.

The more interesting comparison is the `DPIBreak` entry under See Also, described as a kernel based circumvention tool for Linux and Windows. That is a different layer entirely. A userspace proxy like this one sees traffic as it passes through and can reshape it, but it only affects traffic routed through it, and it depends on the local network letting the packets through at all. A kernel based tool sits in the network stack and can act on every flow without a proxy hop, at the cost of requiring privileged installation on a specific platform.

There are limits worth stating plainly. Nor does it help against an operator who can observe both ends of a connection and correlate them, since desynchronisation defeats signature matching rather than traffic analysis. And the README's refusal of mobile platforms means there is no supported story for a phone, which rules the tool out for anyone whose only general purpose computer is one.

Editorial conclusion

SpoofDPI is a good fit when the censor is a middlebox on your own network and you control a desktop machine, and a poor fit when you need something on a phone. What the repository settles is the mechanism, the dependency set and the build: a static binary from a scratch container, gopacket and gvisor underneath, a TOML config library. What it does not settle is which specific inspection technique any given network operator runs, because that is not knowable from a public repository. The last push was on 2026-10-16, the same day as the newest tagged release, v1.5.5. Read the docs at spoofdpi.dev before trusting a build, and take binaries only from GitHub releases or a distro package, which is the one instruction the README puts in a caution block.

Frequently asked questions

Official sources

1. License: Apache-2.0
2. Project website
3. README
4. Releases
5. xvzc/spoofdpi on GitHub