smithproxytraffic inspection proxy

OPEN SOURCE · GPL-3.0

See what moves
through your network.

Smithproxy is a fast, policy-driven TCP, UDP and TLS inspection proxy for Linux. Capture decrypted traffic, inspect modern protocols and control how connections are handled.

Read the docs View on GitHub
C++17LinuxIPv4 + IPv6Transparent + explicit
smithproxy CLI
smithproxy# diag proxy session list

MitM|l:ssl_10.0.0.42:53124 <+>
     r:[sni]example.net:443 policy: 3
     up/dw: 24.8k/91.2k (HTTP)

MitM|l:tcp_10.0.0.18:49822 <+>
     r:1.1.1.1:53 policy: 1
     up/dw: 1.2k/3.8k (DNS)

Proxy performance: upload 26.0kbps,
download 95.0kbps in last 60 seconds
TCP / UDP / TLSOne policy engine
PCAPNG + GREDecrypted capture
SOCKS + CONNECTExplicit proxy modes
HTTP/1 · HTTP/2 · QUIC** QUIC is experimental

CAPABILITIES

Inspection without a black box.

Smithproxy combines transparent interception, explicit proxy listeners and a firewall-like policy model in one inspectable C++ codebase.

01

Traffic interception

Intercept routed and locally originated TCP, UDP and TLS traffic, or accept clients through SOCKS4/5 and HTTP CONNECT.

  • TPROXY and REDIRECT
  • IPv4 and IPv6
  • DNS hostname resolution
02

Policy & routing

Match traffic with ordered policies and apply TLS, DNS, content and detection profiles per connection.

  • DNAT and load balancing
  • Outbound TLS SNI rewrite
  • Reject and sinkhole actions
03

Capture & observability

Write intercepted traffic to rotating capture files or stream it to a remote collector for live analysis.

  • PCAP / PCAPNG and GRE export
  • SSLKEYLOG export
  • Connection history and events
04

TLS intelligence

Inspect handshakes, validate certificates and add useful client, server and HTTP fingerprints to session metadata.

  • JA4, JA4S and JA4H
  • OCSP, CRL and Certificate Transparency
  • STARTTLS and KTLS
05

Automation interfaces

Operate the proxy interactively or integrate it with surrounding systems and decision services.

  • Interactive libcli2 CLI
  • Authenticated HTTP API
  • Webhooks and access requests
06Experimental

QUIC & HTTP/3

Current development builds add transparent multi-flow QUIC handling and native HTTP/3 capture visibility.

  • Stream-aware forwarding
  • QPACK header decoding
  • Native capture with TLS secrets

GET STARTED

Choose your path.

Build the current code from source, use the published Linux packages, or run it from a Docker image.

$Build from sourceCurrent code, build notes and issue tracker→ ↓Linux packagesPublished builds and release files→ ◇DockerContainer images and deployment path→

TRAFFIC WORKFLOW

Match. Inspect. Export.

READY TO LOOK INSIDE?

Start with the documentation.

Learn the deployment modes, configure your first policy and inspect a live session.

Open documentation Join Discord