Proxysmart Tech Blog

I am detected as a VPN and other anomalies

The issue is:

  • you buy a proxy or a VPN and want to hide the fact of using a proxy or a VPN
  • you browse to a popular IP checker to get that info
  • they show you are behind a VPN
  • you claim the VPN or the proxy you bought is of a low quality

Is it true? Let’s explain.

First, let’s explain how they detect that a VPN is used. The answer is MTU, a special parameter of TCP session that shows size of a single IP packet. For Fiber/DSL it’s normally 1500. For mobile networks, it varies a lot. It can be from 1380 to 1460. It depends on the internal technologies of a mobile network .

So they detect the MTU, what’s next? Then they find a match using publicly available databases of typical cases (MTU and corresponding Link Type which can be VPN, PPPoE, Ethernet, Mobile etc. From what I know, many use p0f3 or similar databases.

OK, assume a mobile proxy has a totally valid mobile MTU 1460. Check the DB, this MTU has assigned with a label generic tunnel or VPN :

label = generic tunnel or VPN
sig   = 1460

And then the checker assumes you are using a VPN, while it is not true.

If you run own mobile proxies you can put a sim in a phone and browse to the IP checker and you will see that MTU 1380 again and the checker will erraneosly detect you as a VPN.