Modern TLS-shaped transport
GhostCloak uses TLS 1.3, EKM-based authentication masking, and controlled ClientHello/JA3 behavior. This reduces the visibility of the VPN tunnel compared with protocols that are easy for DPI systems to classify.
New GhostMesh protocol
SRSP combines TLS 1.3, GhostCloak masking, native stream multiplexing, and rekey/resume mechanics to keep connections fast and less obvious on restricted networks.
SRSP, or SRS Streaming Protocol, is the GhostMesh transport stack for situations where standard VPN traffic can be unstable, throttled, or identified by network filters. It is built around real TLS transport, controlled ClientHello/JA3 behavior, protected authentication, and efficient reuse of established connections.
These scores are comparative engineering estimates from 0 to 100 based on protocol design and expected behavior; they are not lab measurements, live production telemetry, or completed field validation.
SRSP separates transport, session lifecycle, and VPN/proxy wire format so masking, cryptography, multiplexing, and resource limits can evolve independently.
Transport
GhostCloak over TLS 1.3 with REALITY-style verification and EKM masking
Session
Handshake, ready, rekey, and resume states for resilient operation
Mux
Native stream frames and dispatcher for parallel flows
VPN/proxy
GMNPP v0 with CAPS handshake, TCP CONNECT, and UDP ASSOCIATE
The goal is not only to encrypt traffic, but to make the tunnel resilient, efficient with handshakes, and closer to normal modern web traffic.
GhostCloak uses TLS 1.3, EKM-based authentication masking, and controlled ClientHello/JA3 behavior. This reduces the visibility of the VPN tunnel compared with protocols that are easy for DPI systems to classify.
Native multiplexing lets multiple TCP/UDP flows share a protected transport. The client can keep a warm pool of connections and avoid a new TLS handshake for every request.
The SRSP session layer supports handshake -> ready -> rekey -> resume states, helping connections recover after short network interruptions and refresh key material without a full reconnect.
HLS/DASH-oriented shaping smooths recognizable video traffic bursts and makes connection behavior less abrupt for network analyzers.
SRSP accounts for active checks with rate limiting, masquerade routing, and strict capability validation so suspicious connections do not easily expose the real service.
The protocol is an advanced-beta stack: key pieces are implemented and tested, but field validation on difficult networks is not complete, so VLESS+REALITY-level maturity is not claimed.
This table compares practical protocol profiles: strengths, DPI visibility, speed, and operational maturity.
These scores are comparative engineering estimates from 0 to 100 based on protocol design and expected behavior; they are not lab measurements, live production telemetry, or completed field validation.
Sort by
SRSP / GhostCloak
GhostMeshRestricted networks, streaming, DPI-heavy environments
High: TLS 1.3, JA3 profile, REALITY path, probing guard
High: multiplexing, warm pool, rekey/resume
Restricted networks, streaming, DPI-heavy environments
Advanced-beta: strong architecture, field validation not complete
VLESS + REALITY
Censorship resistance and active-probing defense
Very high and well validated in the Xray ecosystem
High
Censorship resistance and active-probing defense
High: years of deployment and active development
WireGuard
Maximum speed on normal networks
Low: UDP pattern is easy to classify without obfuscation
Very high
Maximum speed on normal networks
Very high
AmneziaWG 2.0
When you want WireGuard ergonomics with an added obfuscation layer
Medium-high: adds obfuscation on top of WireGuard, but has less public field validation than REALITY
Very high
When you want WireGuard ergonomics with an added obfuscation layer
Medium-high: the ecosystem is growing, though long-term field history is still shorter than WireGuard
NaiveProxy
Web-like proxying on restricted networks
High: closer to standard HTTPS traffic
Medium-high
Web-like proxying on restricted networks
Medium-high: the approach is mature, but VPN-product integration is usually narrower
OpenVPN
Compatibility, enterprise, and legacy environments
Medium: TCP/443 helps, but signatures are often recognizable
Medium
Compatibility, enterprise, and legacy environments
Very high
IKEv2 / IPsec
Mobile networks and fast roaming
Low-medium: standard IPsec is commonly visible
High
Mobile networks and fast roaming
Very high
Shadowsocks
Lightweight app-level proxying
Medium: depends on plugins and environment
High
Lightweight app-level proxying
High
Hysteria2 / TUIC
High speed on unstable or long-distance routes
Medium: excellent performance, not always web-like
Very high
High speed on unstable or long-distance routes
High
SRSP is not a universal replacement for every protocol. WireGuard remains excellent on open networks, OpenVPN and IKEv2 win on maturity, and VLESS+REALITY still has deeper field experience against censorship. SRSP gives GhostMesh its own modern transport for networks where masking, resilience, and connection behavior matter.
Use SRSP when stable access, streaming, privacy on restricted networks, and lower tunnel visibility are the priority. On ordinary fast networks, GhostMesh can combine SRSP with other modern protocols and choose the best route for the situation.