SRSP / GhostCloak
GhostMeshMasking92Excellent
Efficiency90Excellent
Resilience85Excellent
GhostMesh transport
The transport behind GhostMesh for Windows and Android. Connect websites and apps through a protected tunnel, without configuring the protocol by hand. Advanced beta: availability depends on your network.
Comparative 0–100 editorial scores for ten protocols. Hysteria3, Mieru, TrustTunnel, OlcRTC, and operator bundles are excluded from the scored set.
Scores are comparative editorial ratings 0–100 for the GhostMesh shipped path and public protocol documentation — not independent laboratory measurements. Bands remain labels for the same scores.
Sort by
SRSP (SRS Secure Session Protocol) is GhostMesh’s transport for Windows and Android. It combines TLS 1.3 and REALITY authentication with connection reuse, session rekey and sticky resume. Prepared egress nodes can use session-bound Native UDP v2; relay nodes have a separate role. These features are integrated, while sustained public comparisons across multiple ISPs remain an open evidence milestone.
Default Windows and Android transport. JA4 is fingerprint camouflage, not a separate cipher.
Required on enabled SRSP nodes; API refuses silent standard TLS fallback.
Default path reuses protected connections for multiple streams.
IPv4 /24 and IPv6 /48 limits, strict validation, and a bounded HTTP masquerade fallback are wired; defense in depth, not indistinguishability.
Default-on for egress (API flags + templates); relay stays off. Live fleet soak still operator-owned.
On the default egress canonical path: jittered RekeyScheduler, UDP v2 owner rotation, server resume tickets. Sustained multi-ISP field history remains shorter than mature stacks.
SRSP separates transport, session lifecycle, and VPN/proxy wire format so camouflage, cryptography, multiplexing, and resource limits can evolve independently.
Transport
GhostCloak over TLS 1.3 with a Chrome 150-shaped ClientHello and REALITY-required
Session
Session keys derive from the TLS 1.3 handshake. Default egress path: canonical session with jittered rekey, sticky resume, and Native UDP v2 (relay remains non-canonical).
Mux
GMNPP full-duplex multiplexing with a warm connection pool
VPN / proxy
Windows Wintun and Android VpnService with TCP CONNECT and UDP ASSOCIATE
Ratings use 0–100 editorial scores for masking, efficiency, and resilience. They are comparative engineering profiles of the GhostMesh shipped path and public protocol documentation—not independent laboratory measurements.
Windows 1.0.366 retries a reachable relay after a direct upstream timeout. It prefers the requested exit country and displays the actual selected server. A relay can increase latency.
October fixes add shared dial backoff and bounded FIN/RST waits so a stalled stream cannot indefinitely delay other traffic. Android readiness follows the selected default route.
A healthy server does not establish reachability from your network. Compare IP, DNS and WebRTC before and after VPN; browser checks cannot validate the protocol or protection of the entire device.
Everything listed here is enabled by default on the shipped Windows and Android path.
The default transport uses TLS 1.3 and a Chrome 150-shaped ClientHello for fingerprint camouflage. JA4 describes that camouflage; it is not a separate cipher.
Enabled SRSP nodes require REALITY keys (mode + hex); the API refuses silent standard TLS fallback.
The default path reuses protected connections for multiple streams through GMNPP multiplexing and a warm pool.
IPv4 /24 and IPv6 /48 limits, strict validation, and a bounded HTTP masquerade fallback are wired. This is defense in depth, not an indistinguishability guarantee.
Default egress runs a canonical session: jittered rekey, sticky resume tickets, and owner rotation. Relay stays non-canonical.
Native UDP v2 is enabled by default on the egress path (API flags + templates). It is not an experimental opt-in.
SRSP is not a universal replacement for every protocol. WireGuard remains excellent on open networks, OpenVPN and IKEv2 win on maturity, and VLESS+REALITY still has deeper censorship-field history. SRSP gives GhostMesh a modern owned transport where masking, resilience, and connection behavior matter—with advanced-beta honesty.
Use SRSP when stable private access on Windows/Android, TLS-shaped camouflage, and mux reuse matter more than multi-year third-party deployment history. On ordinary open networks, GhostMesh can still prefer other modern paths.