gecit

System-level transparent DPI bypass. One command (sudo gecit run) and every TLS connection on the box gets a fake ClientHello injected before the real one, so SNI-inspecting middleboxes log a benign hostname and let the real connection through. No tunnel, no remote server, no per-app config. It does not hide your IP, encrypt your traffic, or provide anonymity — it only prevents DPI middleboxes from reading the SNI in your TLS handshakes.

Built by Bora Tanrıkulu (bora-blog); the bypassing-dpi-with-ebpf post is the design write-up.

Architecture

Same idea on every platform — fake ClientHello with SNI = www.google.com and TTL 8, plus MSS clamped to 88 bytes to fragment the real ClientHello so the SNI extension splits across segments. What differs is the kernel hook.

Linux: eBPF sock_ops. Attaches a BPF program to a cgroup. BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB fires the moment an outgoing TCP connection finishes its three-way handshake — connection up, app hasn't sent data yet. The program clamps TCP_MAXSEG via bpf_setsockopt and forwards seq/ack to a Go goroutine via a perf event. Userspace builds the fake ClientHello and sends it through a raw socket with IP_HDRINCL. After the handshake, traffic stays in-kernel — zero overhead on bulk transfer. See ebpf-sock-ops.
macOS: TUN + gVisor. No eBPF on macOS. Network Extensions need an Apple-approved entitlement, so that path was unrealistic for an open-source tool. gecit uses sing-tun on top of gVisor's userspace TCP/IP stack. Connections to port 443 are routed to the TUN, gVisor terminates the handshake locally, gecit opens its own connection to the real server, fires the fake, then forwards the real ClientHello. Seq/ack scraped from SYN-ACKs via pcap. All traffic crosses the kernel-user boundary — same overhead profile as a VPN.
Windows: TUN + Npcap. Same TUN+gVisor architecture as macOS. Two extra headaches: TCP raw sockets are blocked since Vista (so packet injection goes through Npcap's pcap_sendpacket, which means gecit builds full Ethernet frames including gateway MAC from the ARP table); and most Windows DPI tools use WinDivert, whose code-signing cert expired in 2023 and trips Defender, so gecit uses WireGuard's WinTUN instead. Npcap can't be redistributed without an OEM license, so users grab it from npcap.com themselves.

DNS handling

gecit runs a local DoH server on 127.0.0.1:53 and points the system resolver at it. Queries leave the box over HTTPS to Cloudflare, Google, NextDNS, or whatever upstream you configure — no plaintext DNS for the censor to poison. There's a chicken-and-egg problem: the DoH client itself needs to resolve the upstream hostname before it can take over DNS, so gecit pins all upstream hostnames to IPs at startup.

On macOS, DNS configuration is per network service; gecit picks the active one off the default route (so it sets DNS on the USB-tethering service when you're tethered, not Wi-Fi). On Linux with Flatpak, sandboxed apps don't see /etc/resolv.conf changes, so DNS bypass has to be set manually inside each Flatpak — but the DPI bypass still works there because eBPF runs below every sandbox.

Usage

sudo gecit run

That's the whole interface. TTL, fake SNI, MSS, target ports, and DoH upstream are all tunable; defaults are TTL=8, SNI=www.google.com, MSS=88, ports=443.

Tuning hints from the post: if it doesn't work, traceroute to figure out a TTL that lands between the middlebox and the server. If pcap can't catch the SYN-ACK on macOS/Windows, the fake ships with garbage seq/ack and the DPI rejects it.

Where it fits in the bypass landscape

gecit defeats SNI-only DPI. It does not give you a foreign exit IP, so it does not defeat CIDR-whitelist regimes like the one tspu runs on Russian mobile carriers — for that you still need a tunnel. It's the kernel-level cousin of zapret / GoodbyeDPI / ByeDPI, listed in russia-vpn-bypass-state-2026-04 as orthogonal companions to a real VPN. The implementation is a useful reference point for anyone who's wondered why eBPF is structurally different from the macOS/Windows network-extension story; see ebpf-sock-ops for the hook details.

tls-desync-fake-clienthello — the technique
ebpf-sock-ops — the Linux kernel hook
bypassing-dpi-with-ebpf — the design post
bora-blog — author
little-snitch-linux — different eBPF networking tool, different hook category (per-app monitoring vs handshake injection)

Repo

github.com/boratanrikulu/gecit, GPL-3.0. Linux, macOS, Windows.