Skip to content

TCP OS spoofing (anti TCP/IP fingerprinting)

TCP OS spoofing aligns your proxy's network signature with the OS your browser claims. Windows, macOS, Linux, Android or iOS, your pick.

update Updated

Why the IP address alone is no longer enough

Modern protection systems (Cloudflare, DataDome, Akamai, Kasada) no longer stop at inspecting the IP address and the HTTP headers. They also analyse the transport layer, from the very first TCP handshake.

If your antidetect browser claims to run Windows 11 while your network packets carry the signature of a Linux kernel, the inconsistency is immediate. TCP OS spoofing closes that gap by rewriting the characteristics of the network stack at the level of the initial packet, so that the network layer and your browsing profile agree.

What a TCP SYN packet gives away (the p0f principle)

Passive operating-system identification (popularised by the p0f tool) rests on a simple fact: every OS family implements the TCP/IP stack with its own default values.

From the very first TCP SYN packet your machine sends, a remote observer reads:

  • The initial TTL (Time To Live): 128 on Windows, 64 on Linux, Android and macOS.
  • The initial window size: values and scaling factors specific to each OS.
  • The ordering of TCP options: the exact order in which MSS (Maximum Segment Size), SACK Permitted, Timestamps, NOP and Window Scale appear.
  • The state of the DF flag (Don't Fragment): set or not depending on the system.

That analysis is passive and takes microseconds, without running a single line of JavaScript, and before the TLS negotiation or the HTTP requests even begin.

Why an ordinary proxy creates an identity conflict

Most proxy servers and mobile gateways run on Linux or Android.

When you launch a profile simulating a Windows desktop through an ordinary proxy:

  1. Your browser sends a User-Agent declaring Windows 10 or 11.
  2. The website receives the TCP connection established by the remote proxy device (a Linux machine or an Android smartphone).
  3. The server sees a TTL of 64 with TCP options typical of Linux, whereas a Windows desktop would have sent a TTL of 128 with a different option sequence.

To a detection engine, that divergence between the application layer and the network layer is a strong sign of automation or proxy use. TCP OS spoofing steps in exactly there: it intercepts the outgoing TCP SYN packet and alters its flags so that it takes on the exact shape of the OS your browser claims.

Settings available at FRProxy

TCP OS spoofing runs directly on the hardware carrying your dedicated 4G/5G mobile line. There is no third-party software and no network driver to install on your own machine.

You control it from your account or through the API (POST /api/v1/spoof):

  • Selectable fingerprints: Windows, macOS, Linux, Android and iOS.
  • Default behaviour: disabled (the modem's native fingerprint passes through).
  • Availability: active on our dedicated 4G/5G proxy plans on phones and compatible hardware.

On a dedicated line, your setting applies instantly to every flow going through your HTTP or SOCKS5 port.

One thing to know before you buy: the setting lives on the source, not on the proxy. Two proxies that share one source therefore share the fingerprint too, and the last setting saved is the one that wins. On a dedicated line the question does not arise: you are the only one on it.

The technical reality: IPv4 against IPv6

We stay pragmatic about the physical limits of the network:

  • On IPv4 (the effect of CGNAT and DPI): some mobile carriers and intermediate routers use deep packet inspection (DPI) equipment that rewrites or reorders TCP options along the way, to optimise cellular bandwidth. That normalisation can alter part of the injected fingerprint. It is a structural constraint of shared IPv4 routing, and it applies to the whole market.
  • On IPv6 (direct routing): there is no CGNAT. The packet travels end to end without any intermediate alteration of its network options. The spoofed TCP fingerprint reaches the remote server strictly intact.

How to check your TCP fingerprint

To check the consistency of your network chain before starting sensitive sessions:

  1. Open your browser configured with the proxy.
  2. Visit passive analysis tools such as browserleaks.com/ip or iphey.com.
  3. Look at the TCP/IP Fingerprint or OS (p0f) section: the detected OS must match the one simulated in your antidetect profile.

FAQ

Does OS spoofing make me undetectable?

No, and nobody should promise you that. It removes one specific technical anomaly: the divergence between your TCP network signature and the OS your browser declares. An antifraud filter weighs a bundle of clues: IP reputation, Canvas and WebGL fingerprints, timezone consistency, DNS/WebRTC leaks and click behaviour. OS spoofing removes one critical warning signal; it does not replace good browsing hygiene.

Why does my test sometimes still show Android despite the spoofing?

Our proxies run on real phones and mobile modems: Android is the native hardware fingerprint underneath. If it shows up in a test while you selected Windows, it means the change did not survive the mobile carrier's IPv4 transit (TCP options normalised by the radio network). Switch your test to our IPv6 exit: with no carrier CGNAT, the packet is not rewritten and the spoofed fingerprint arrives intact.

See also: What is a mobile proxy? · WebRTC and DNS leaks · Compartmentalizing what you do

Need a French mobile proxy? A real French 4G/5G line, one HTTP port and one SOCKS5 port, IP rotation on demand.

See the offersarrow_forward
grid_viewWiki