Skip to content
Proxies

How Is a Proxy Detected by Latency? WebSocket Round Trips vs the TCP Handshake

Pim

Pim · Scrappey Research

October 28, 2026 4 min read

How Is a Proxy Detected by Latency? WebSocket Round Trips vs the TCP Handshake — conceptual illustration
On this page

Latency-based proxy detection compares two round-trip times on the same connection: the TCP handshake, which only reaches the proxy exit, and an application-level echo, which reaches the code that is really running. On a direct connection the two are close. Behind a proxy that opens its own TCP connection to the server, the echo includes every hidden hop and the handshake does not, so the gap between them is roughly the length of the hidden path.

Quick facts

SignalApplication round trip minus TCP round trip on one connection
Common thresholdAbout 50 ms in published work
Published error ratesCalcuLatency: 0.95% false positives; BADPASS: 0.04% at 50 ms
CatchesApplication-layer proxies far from the real client (HTTP CONNECT, SOCKS, residential networks)
Does not catchA nearby exit, or a network-layer VPN that carries the client's own TCP handshake

Two round trips on one connection

Every TCP connection starts with SYN, SYN-ACK, ACK. The server can time the gap between its SYN-ACK and the ACK, which is the round trip to whatever opened the connection. Through an HTTP CONNECT proxy, a SOCKS proxy or a residential proxy network, the proxy opens a new TCP connection to the server, so the handshake only measures the last hop.

An echo is different. If the page sends a timestamp over a WebSocket and the server sends it back, the reply has to travel all the way to the code that sent it: browser to proxy, proxy to exit, exit to server, and back. The application round trip includes every hop. Subtract the TCP round trip and what is left is the hidden part of the path.

Since late October 2026 at least one widely deployed challenge widget runs this probe: it opens a WebSocket to its own host, sends String(performance.now()) and records six echoes with a 500 ms budget. What the server then does with the values is not visible from outside, but the pattern matches the published technique.

What the numbers look like

Published measurements:

  • CalcuLatency (USENIX Security 2024) compared a WebSocket round trip from the page with the TCP handshake. At a 50 ms threshold it reported 0.95% false positives and 2.9% false negatives. Two thirds of the VPNs it missed were within about 1,050 km of the user.
  • BADPASS (ISPEC 2022) compared TLS and TCP round trips over 92.7 million connections through four residential proxy providers. 97% of direct connections differed by 20 ms or less; at 50 ms the false-positive rate was 0.04%.

An October 2026 test from Amsterdam with Chrome 156 and a public echo server gave:

PathEcho round tripWebSocket open
Directabout 12-18 ms47-62 ms
Residential exit, same country48-64 ms (about +38 ms)about 270 ms
Exit in the US400-470 ms1.6-1.8 s

The server saw a home IP in every case. With a 500 ms budget, the direct run finishes all six echoes, the same-country exit runs out after about four, and the US exit times out before the socket opens. Note the limit: the same-country exit added 38 ms, under the 50 ms line. Latency catches distance, not proxies as such.

What follows for proxy setups

No browser setting changes a round trip, and the TCP side is measured on the server, out of reach of the page. The practical answers are about network design:

  • Keep the browser near the exit. Run the browser in or near the exit's region, so the hidden path is short.
  • Keep the chain short. Every extra hop (a gateway, a second proxy, a tunnel to a remote worker) adds to the echo but not to the handshake.
  • Make the rest agree. Timezone, language and the WebRTC path have to fit the exit too, or the latency gap is only one of several contradictions. See timezone and IP mismatch.

This is a placement problem more than a configuration problem, which is why a managed web data API that runs browsers next to its proxy exits avoids it, while a browser on one continent behind an exit on another cannot fix it from inside the page.

Code example

javascript
// Measure application round trips the way a page can.
// Run in the browser console on any page; uses a public echo server.
const ws = new WebSocket('wss://echo.websocket.org');
const created = performance.now();
const rtts = [];

ws.onopen = () => {
  console.log('socket open after', (performance.now() - created).toFixed(1), 'ms');
  ws.send(String(performance.now()));
};

ws.onmessage = (ev) => {
  const sent = Number(ev.data);
  if (Number.isNaN(sent)) return;          // skip the server's greeting
  rtts.push(performance.now() - sent);
  if (rtts.length < 6) ws.send(String(performance.now()));
  else {
    ws.close();
    rtts.sort((a, b) => a - b);
    console.log('echo RTTs (ms):', rtts.map(r => r.toFixed(1)).join(', '));
    console.log('median:', ((rtts[2] + rtts[3]) / 2).toFixed(1), 'ms');
  }
};

// Run it once direct and once through your proxy. The difference between the
// two medians is roughly what a server sees as the gap above its TCP RTT.

Related terms

What Is Residential Proxy Detection?
Residential proxy detection is how anti-bot systems spot traffic that is being routed through a residential proxy pool — a network of IP add…
What Is a Residential Proxy?
A residential proxy sends your web traffic through a real home internet connection — a regular broadband or fiber line — instead of through …
What Is a Timezone / IP Mismatch?
A timezone/IP mismatch is when the location a browser claims and the location of its IP address disagree. Anti-bot systems (the software sit…
What Is a WebRTC IP Leak?
A WebRTC IP leak is when your browser quietly reveals your real IP address — even though you set up a proxy to hide it. It is the most-overl…
What Is Proxy Web Scraping?
Proxy web scraping means sending your scraper's traffic through proxy servers — middleman machines that forward your requests for you — so t…
What Is a Proof-of-Work Challenge?
A proof-of-work challenge makes the browser search for a value whose hash meets a condition, usually a SHA-256 digest that starts with enoug…
Concept map

Concept map

How How Is a Proxy Detected by Latency connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections
You are here · Proxies
Building map…

Tools & solutions for this topic

Frequently asked questions

Does a residential proxy hide latency?

No. A residential exit gives the server a home IP, but the echo still travels to wherever the browser really runs. In an October 2026 test, a same-country residential exit added about 38 ms and a US exit from Europe added about 400 ms.

Are VPNs detected the same way?

Not by this comparison alone. A network-layer VPN such as WireGuard or OpenVPN carries the client's own TCP handshake, so the handshake and the echo both include the full path and show no gap. Published systems add ICMP pings or traceroutes for that case.

What latency gap is considered suspicious?

Published work uses about 50 ms between the application round trip and the TCP round trip. 97% of direct connections in one large study differed by 20 ms or less.

Last updated: 2026-10-28 · Facts last verified: 2026-10-28