Hysteria2 is one of ProofKit's transports. It runs over QUIC on UDP (UDP port 443 by default) with Salamander obfuscation on top. It is charged per GB at your route's price, like Reality and XHTTP.
How Salamander hides it
Salamander scrambles every packet with a per-packet salt and a password from your link, including the first packet, which would otherwise carry the TLS handshake. On the wire there is no QUIC header and no server name to fingerprint, just UDP packets.
- Because the name is hidden, the cover site does not matter here, unlike with Reality.
- The node uses its own self-signed certificate, and your link pins its SHA-256 hash, so no certificate authority is involved.
When to use it
- UDP is allowed but Reality over TCP is throttled.
- A lossy or long link: QUIC copes with packet loss better than TCP.
Limits
- It needs UDP. Where UDP is blocked or throttled, as on some mobile and office networks, it won't connect; use Reality or XHTTP.
- Some networks slow down unknown UDP traffic.
Apps and routes
Happ, Hiddify and V2RayNG run it. It works on direct routes and on 2-hop routes, where the entry node relays the UDP. Not sure which transport to use? See Choosing a transport.