Sniffer

Sniffing reads the first bytes a client sends on a new TCP connection to find the domain it is talking to. Domain rules (DOMAIN-SUFFIX, GEOSITE, domain rule providers, …) can then match even when the connection arrived as a bare IP address.

This matters when:

• you use redir-host DNS mode, where connections arrive with real IPs;
• an app uses its own DNS (for example DNS over HTTPS) or connects to a hard-coded IP, bypassing MeowX’s DNS;
• many sites share one CDN address — only the sniffed name tells them apart.

Configuration

sniffer:
  enable: true

Key	Type	Default	Description
enable	bool	true	Turn sniffing on or off.

Note

Unlike mihomo, where the sniffer is off unless configured, MeowX sniffs by default. A subscription without a sniffer section gets sniffing. Set enable: false to turn it off.

All other mihomo sniffer options — sniff (per-protocol ports), force-domain, skip-domain, skip-src-address, skip-dst-address, override-destination, force-dns-mapping, parse-pure-ip — are ignored. MeowX doesn’t look at ports: it recognizes the protocol from the content.

What is sniffed

Protocol	Source of the domain
TLS	The server name (SNI) in the ClientHello, including ClientHellos split across several TLS records.
HTTP/1.x	The Host header of the first request (methods GET, POST, PUT, HEAD, DELETE, OPTIONS, PATCH, CONNECT, TRACE).

The domain is lowercased, and any port and trailing dot are removed. QUIC and other UDP traffic is not sniffed.

When it runs

MeowX determines the domain of a new TCP connection in this order and stops at the first that succeeds:

1. fake-ip: the address belongs to the fake-ip range, so the domain is already known.
2. Sniffing, if enabled.
3. Recent DNS answers (redir-host): the domain whose answer contained this IP.

Connections that come in through the local HTTP / SOCKS5 proxy already carry a domain and aren’t sniffed.

Timeout

Sniffing waits up to 300 ms for the client’s first bytes and reads at most 16 KB. TLS and HTTP clients send immediately, so this normally costs nothing. If the first bytes clearly aren’t TLS or HTTP, sniffing stops at once. Protocols where the server speaks first (some mail, SSH and game protocols) wait out the 300 ms and then continue without a domain.

Bytes read while sniffing aren’t lost: they are passed to the outbound connection unchanged.

Tip

In fake-ip mode, connections made after a lookup through MeowX’s DNS already have a domain and skip sniffing entirely, so the 300 ms wait only applies to apps that connect to IP addresses directly.