# How sites detect a proxy with latency: two round trips > A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel. Source: https://mosaicbrowser.com/blog/proxy-detection-by-latency ## Detecting a proxy with two clocks A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel. ![2 clocks: Two round trips, and the gap between them](https://mosaicbrowser.com/covers/proxy-detection-by-latency.webp) A site can detect a proxy with latency by timing two round trips and comparing them. The first is the TCP handshake, which ends at the proxy's exit. The second is a round trip that has to reach the browser itself, such as a WebSocket ping. On a direct connection the two take about the same time. Behind a proxy, the second one is longer, and the difference is the time your traffic spends in the tunnel. It is one of the few proxy checks that needs no list of addresses and no knowledge of who owns the exit. Physics does the work. ## Clock one: the TCP handshake When your browser connects to a site through an HTTP or SOCKS5 proxy, the browser does not open the connection to the site. The exit does. The site's server sends its SYN-ACK to the exit, the exit's operating system answers with the final ACK, and the server's kernel now has a round-trip time for that connection: server to exit and back. On Linux a server can read that figure for any open socket, without any code in the page. It is a measurement of the exit's distance from the server, and it never touches your computer. (The same connection also carries the exit's TCP fingerprint, not yours, which is [the TCP half of this story](https://mosaicbrowser.com/blog/tcp-fingerprint-belongs-to-the-exit).) Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## Clock two: a round trip that reaches the browser The second clock has to measure something only the browser can answer. Three ways a server can get it: 1. A WebSocket. The page opens one, the server sends a small message, the page echoes it, and the server times the echo on its own clock. This is the method Nikolai Tschacher described in his write-up on incolumitas.com. 2. The TLS handshake. Through a proxy, HTTPS is a tunnel: the exit relays bytes, and the TLS handshake happens between the server and your browser. The server can time the gap between sending its handshake messages and receiving your browser's reply, with no JavaScript at all. 3. HTTP/2 PING frames, which the browser's network stack answers on an open connection. Each of these travels server to exit, then exit through the proxy back to your browser, then all the way back. So the reading is clock one plus the tunnel. ## How the gap detects a proxy with latency Subtract clock one from clock two and you get roughly the round trip from the exit to the browser. On a direct connection that is close to zero, plus a few milliseconds of processing and the Wi-Fi in your flat. Behind a proxy it is however long the path from the exit back to you takes. Light in optical fibre covers about 200 km per millisecond, so each millisecond of round trip allows at most about 100 km of distance each way, and real routes are slower than straight lines. A gap of 5 ms is a nearby relay at most. A gap of 100 ms means your browser is somewhere far from the address the site is seeing. Detectors treat it as a signal, not a verdict, because ordinary networks add noise. A phone on a weak mobile signal, a congested home router or a busy laptop can stretch the browser-side round trip with no proxy anywhere, so a careful detector takes several samples and uses the smallest. ## Why a VPN does not show the same gap A VPN forwards your computer's own packets inside a tunnel. The SYN-ACK goes through the tunnel to your machine, and your machine sends the ACK. So the TCP handshake already includes the tunnel, both clocks agree, and the gap disappears. VPNs are caught by other means, such as the smaller packet size a tunnel forces on every connection ([MSS and MTU through a tunnel](https://mosaicbrowser.com/blog/mss-and-mtu-through-a-tunnel) has the numbers). ## Residential proxies have a second leg A residential proxy usually has two hops. Your browser talks to the seller's gateway, a server in some data centre, and the gateway relays to a home connection that acts as the exit ([how residential proxies work](https://mosaicbrowser.com/glossary/residential-proxy)). The tunnel in the gap is both legs: exit to gateway, and gateway to you. So an exit in your own city can still show a large gap if the gateway is on another continent. ## What we can and cannot do about it Nothing inside a browser can shrink the gap. Both readings are taken on the server, from its kernel and its own timestamps, and a browser can only lie to a page about what time it thinks it is. Packets still take as long as they take. Tesseract Chrome, our own Chromium, does not try to fake network timing, and we would distrust any tool that claimed to: a page clock that disagrees with the network is one more contradiction. The lever is geography. Pick an exit near where your computer sits, and if your seller offers gateway hostnames by region, use the one nearest you. Mosaic's proxy check reports the latency it measured through each proxy before a profile uses it, which is a fair first reading of how long that path is ([how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it) covers the rest of what to look at). ## Questions ### How can a website detect a proxy with latency? It measures two round trips. The TCP handshake ends at the proxy's exit, so its round trip is server to exit. A WebSocket ping or a TLS handshake goes all the way to the browser. Without a proxy the two are close; behind one, the second is longer by the time the tunnel takes. ### Does latency detection catch a VPN? Not this way. A VPN forwards your own packets, so the TCP handshake also travels the whole tunnel and both clocks include it. Sites look for VPNs with other signals, such as a packet size shrunk by the tunnel. ### Can a browser setting hide proxy latency? No. The server takes both readings on its own side, from its kernel and its own timestamps. A browser can lie to the page about time, but it cannot make packets arrive sooner. ### How do I keep the latency gap small? Use an exit, and a proxy gateway, close to where your computer is. The gap is the time from the exit back to you, so a short path makes a small gap. ## Related [Through a proxy, your TCP fingerprint is the exit's](https://mosaicbrowser.com/blog/tcp-fingerprint-belongs-to-the-exit): A proxy's exit opens its own TCP connection, so the TTL, window and options a site reads come from the exit's system, not your browser or your computer. [MSS 1300: what an MSS value says about VPN detection](https://mosaicbrowser.com/blog/mss-and-mtu-through-a-tunnel): VPN detection by MSS value: a tunnel shrinks the MSS in every SYN. A proxy opens a new connection at the exit, so a site reads the exit's MSS. [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [Residential proxy: an exit on a home internet connection](https://mosaicbrowser.com/glossary/residential-proxy): A residential proxy sends your traffic out through an address an ISP assigned to a home connection, so sites see a household rather than a data center. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [Pin the country, not the address](https://mosaicbrowser.com/blog/pin-the-country-not-the-address): A residential pool moves your exit whatever you do. The checks that matter compare countries, so pin the country and let the address move inside it. [Peru, Brazil and Bahrain in three requests](https://mosaicbrowser.com/blog/three-countries-three-requests): A rotating proxy with no country pin can exit in a different country on every request. Fine for a stateless scrape, fatal to a profile that keeps one timezone. [Our proxy relay told the gateway it was a script](https://mosaicbrowser.com/blog/the-relay-that-looked-like-a-script): Chrome sends Proxy-Connection: keep-alive, lower case, to every proxy. Our relay sent Keep-Alive, no User-Agent and Connection: close, until we copied Chrome. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.