Updated July 2026 · 6 min read
When to enable domain sniffing
If domain rules suddenly stop working once TUN is on, it is usually because the core only sees an IP address. The sniffer is what gets the hostname back.
Why rules stop matching under TUN
TUN captures traffic at the network layer, so the core receives a destination IP rather than a name. Rules like DOMAIN-SUFFIX have nothing to compare against and fall through to GEOIP or your catch-all.
The sniffer reads the SNI from the TLS handshake and the Host header from plain HTTP, reconstructing the hostname so domain rules have something to match.
A minimal working config
Add a sniffer block, set enable to true, and turn on the protocols you need under sniff: HTTP, TLS and QUIC. Do not skip QUIC — plenty of sites now default to HTTP/3.
Reload the profile and look at the Host column in Connections. Rows that used to show a bare IP should now show a hostname, and the Rule column should switch to your domain rules.
You do not need the sniffer when you only use the system proxy — the HTTP proxy protocol already carries the hostname.
The trade-off in override-destination
With it on, the core replaces the original destination with the sniffed hostname, so rules and groups operate on names. That behaves most like a browser connecting directly.
But if you reach some services by IP on purpose, or the certificate does not match the name, the replacement breaks the connection. Add those to skip-domain instead of turning sniffing off entirely.
Do not expect it to solve everything
Encrypted SNI and pure IP traffic cannot be sniffed, so IP rules and process rules still have to cover that part.
Sniffing means parsing one more handshake, which costs very little latency but not zero. Enable only the protocols you actually use rather than ticking all three by default.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.