# How to Use Multisplit Desync for DPI Bypass in zapret-discord-youtube

> Learn how to bypass DPI with multisplit desync. This technique fragments TLS packets to evade inspection, ensuring seamless access to Discord and YouTube.

- Repository: [Flowseal/zapret-discord-youtube](https://github.com/Flowseal/zapret-discord-youtube)
- Tags: how-to-guide
- Published: 2026-05-02

---

**Multisplit desync fragments TLS ClientHello packets into overlapping TCP segments, causing deep packet inspection engines to fail signature matching while the legitimate endpoint reassembles the stream correctly.**

The `zapret-discord-yououtube` repository distributes **WinWS** (`winws.exe`), a WinDivert-based traffic interceptor that rewrites TCP streams on-the-fly. Its **multisplit desync** capability represents one of the most robust methods for evading DPI-based blocking, particularly against firewalls that expect contiguous TLS handshake signatures.

## How Multisplit Desync Bypasses DPI

Deep packet inspection engines typically perform single-pass pattern matching on the first few hundred bytes of a TCP stream. **Multisplit desync** exploits this limitation by cutting the TLS ClientHello into multiple fragments with sequence overlaps.

The algorithm operates as follows:

1. **Load a binary pattern** from `bin/tls_clienthello_www_google_com.bin` (or similar files) containing a raw TLS ClientHello packet.
2. **Split the byte stream** at the position specified by `--dpi-desync-split-pos`.
3. **Create overlapping fragments** where the second packet starts `seqovl` bytes before the first packet ends, generating redundant data that confuses stateful inspection.
4. **Transmit fragments** with minimal inter-packet delay, allowing the receiving server to reassemble the valid handshake while the DPI engine sees only disjointed, non-matching segments.

Because the target server reconstructs the full TLS handshake from the overlapping fragments, the connection establishes normally. The DPI device, however, fails to locate its blocking signature across the fragmented boundary.

## Source Files and Architecture

Implementing **multisplit desync for DPI bypass** requires three core components from the repository:

- **`bin/winws.exe`** – The WinDivert driver interface that performs the actual packet interception and fragmentation.
- **`general.bat`** (and variants like `general (ALT2).bat`, `general (ALT6).bat`) – Batch scripts that assemble the command-line arguments, referenced at line 19 in the base file.
- **`bin/*.bin` pattern files** – Pre-generated TLS ClientHello blobs (e.g., `tls_clienthello_www_google_com.bin`, `tls_clienthello_4pda_to.bin`) used as the fragmentation template.

## Essential Command Line Parameters

To activate multisplit mode, launch `winws.exe` with the following flags:

- **`--dpi-desync=multisplit`** – Required flag that enables the multisplit algorithm.
- **`--dpi-desync-split-seqovl=<bytes>`** – Defines the sequence overlap length between fragments. Common values include `568`, `652`, and `681`.
- **`--dpi-desync-split-pos=<offset>`** – Specifies the byte position from the packet start where the first split occurs. Typically set to `1` or `2`.
- **`--dpi-desync-split-seqovl-pattern=<path>`** – Absolute or relative path to the binary pattern file used as the fragmentation source.

## Practical Configuration Examples

The repository provides working implementations in the `general*.bat` scripts. The following examples demonstrate how to configure **multisplit desync** for different scenarios:

### Basic Google Services Bypass

```bat
start "zapret: multisplit-google" /min "%BIN%winws.exe" ^
  --wf-tcp=80,443 ^
  --dpi-desync=multisplit ^
  --dpi-desync-split-seqovl=681 ^
  --dpi-desync-split-pos=1 ^
  --dpi-desync-split-seqovl-pattern="%BIN%tls_clienthello_www_google_com.bin" ^
  --new

```

This configuration corresponds to the parameters found at `general.bat` line 19, using a 681-byte overlap to target Google-hosted services.

### Alternative Pattern for Russian Services

```bat
start "zapret: multisplit-4pda" /min "%BIN%winws.exe" ^
  --wf-tcp=80,443 ^
  --dpi-desync=multisplit ^
  --dpi-desync-split-seqovl=568 ^
  --dpi-desync-split-pos=1 ^
  --dpi-desync-split-seqovl-pattern="%BIN%tls_clienthello_4pda_to.bin" ^
  --new

```

This variant uses the `tls_clienthello_4pda_to.bin` pattern with a smaller 568-byte overlap, optimized for bypassing restrictions on Russian platforms.

## Tuning Parameters for Your Network

Adjust these three variables to optimize **multisplit desync** against specific DPI implementations:

| Parameter | Typical Values | Effect |
|-----------|----------------|--------|
| `--dpi-desync-split-seqovl` | `568`, `652`, `681` | Larger overlaps increase redundancy, helping against DPI systems that discard out-of-order packets. Smaller values reduce bandwidth overhead. |
| `--dpi-desync-split-pos` | `1`, `2` | Moving the split position deeper into the packet can evade middle-box inspection that examines only the first few bytes. |
| `--dpi-desync-split-seqovl-pattern` | `tls_clienthello_www_google_com.bin`, `tls_clienthello_4pda_to.bin` | Select a pattern matching your target service's TLS fingerprint to ensure the fragments resemble legitimate traffic. |

When one configuration fails, cycle through the `general (ALT*).bat` variants—each contains pre-tuned combinations of these parameters for different ISP filtering behaviors.

## Step-by-Step Activation

Follow these steps to deploy **multisplit desync for DPI bypass**:

1. **Download and extract** the latest release archive from the `Flowseal/zapret-discord-youtube` repository.
2. **Review the `general*.bat` files** in the root directory to identify which variant matches your target service (Google, Discord, YouTube, or regional alternatives).
3. **Execute the batch file** by double-clicking it—this launches `winws.exe` with the configured multisplit flags minimized to the system tray.
4. **Verify operation** by checking Task Manager for a running `winws.exe` process with a lock icon.
5. **Test connectivity** to the blocked service. If access remains restricted, terminate the process and try an alternative `ALT` script or manually adjust the `seqovl` and `pos` values.

## Summary

- **Multisplit desync** fragments TLS handshakes using configurable sequence overlaps to defeat signature-based DPI.
- The technique relies on `winws.exe` (located in `bin/winws.exe`) and pre-generated pattern files (`.bin`) shipped with the repository.
- Key parameters include `--dpi-desync-split-seqovl` for overlap size and `--dpi-desync-split-pos` for fragmentation offset.
- The `general.bat` script and its variants provide ready-to-use configurations; modify them or create custom batches to tune the bypass for specific networks.
- Unlike simple splitting, multisplit maintains protocol validity through overlapping fragments that servers reassemble correctly while DPI engines fail to match patterns.

## Frequently Asked Questions

### What is the difference between multisplit and other desync methods?

**Multisplit** specifically refers to fragmenting a single packet into multiple overlapping TCP segments using sequence number manipulation. Other methods like `fake` or `disorder` may inject fake packets or simply send segments out of order without the precise overlap control that multisplit provides. The overlap ensures that even if the DPI drops one fragment, the server still receives sufficient data to reconstruct the handshake.

### Why does the overlap size matter for DPI bypass?

The **sequence overlap** (`seqovl`) determines how many bytes each fragment shares with its neighbor. Larger overlaps (e.g., 681 bytes) force the DPI to process more redundant data, increasing the chance that its stateful tracking buffer overflows or fails to reassemble the stream for inspection. However, excessive overlap may degrade performance, so values between 568 and 681 bytes represent the typical effective range found in the repository's batch files.

### Can I use custom binary patterns instead of the provided `.bin` files?

Yes. The `--dpi-desync-split-seqovl-pattern` parameter accepts any file path containing a raw binary TLS ClientHello packet. You can generate custom patterns by capturing legitimate handshake packets to your target service using tools like Wireshark, saving the payload bytes, and referencing that file in your batch script. Ensure the pattern matches the specific TLS version and cipher suites expected by your target server.

### Why does my connection fail even with multisplit enabled?

If **multisplit desync** fails to establish a connection, your ISP may employ DPI that reassembles TCP streams before inspection or uses stateful tracking that tolerates fragmentation. Try increasing the `seqovl` value to 652 or 681, moving the `split-pos` to 2, or switching to an alternative pattern file. Additionally, combining multisplit with other WinWS flags (such as `--dpi-desync=fake`) or testing different `general (ALT*).bat` variants often resolves compatibility issues with aggressive filtering systems.