Home/Glossary
Clash Glossary & Protocol Reference
Keep getting stuck on a term while reading the tutorials? This page breaks down the terminology and protocols that trip up beginners most in the Clash ecosystem.
Core Terms
The background program that actually handles proxying and rule matching — no interface. Historically there have been a few stages: Clash (the original project, now discontinued), Clash.Meta (the community's enhanced fork), and mihomo (the continuation of Clash.Meta after a rename) — each building on the last.
The graphical software wrapped around the core, such as Clash Verge, ClashX, or Stash. It visually manages subscriptions, nodes, and rules, but doesn't process network traffic itself.
A URL generated by a proxy service provider. The client periodically visits this link to fetch the latest node list and configuration — essentially a "cloud config file" that updates itself without any manual work.
Deciding whether each connection should go direct or through a proxy — and which proxy node — based on predefined conditions like domain, IP, or port. This is the biggest difference between Clash and a "blanket VPN."
A web interface that connects to the core via the external-controller API, used to view connection lists, traffic graphs, and latency test results in real time. Most GUI clients already have this panel built in.
General terms for “using a network proxy tool to reach content that's blocked or restricted” — proxies, VPNs, and similar tools all fall under this umbrella. Clash belongs to the rule-based routing category of these tools, a different approach from a blanket VPN that tunnels every connection indiscriminately.
Proxy Protocol Comparison
Clash supports connecting to multiple proxy protocols — they simply differ in "how the node and client communicate." Understanding the differences helps when choosing a subscription or setting up your own node:
Shadowsocks (SS)
- The earliest popular lightweight encrypted proxy protocol
- Simple to implement and fast — supported by nearly every client
- Traffic patterns are relatively easy to identify, with average resistance to blocking
VMess
- A protocol from the V2Ray project, adding identity verification and more flexible transport-layer encapsulation on top of SS
- Supports WebSocket, gRPC, and other transports to disguise traffic as normal web traffic
- More configuration options; widely used in the proxy provider/subscription ecosystem
VLESS
- A lighter protocol released later by the V2Ray team, removing VMess's redundant encryption layer
- Typically paired with TLS/XTLS transport, with better performance than VMess
- Requires relatively newer client and server versions
Trojan
- Disguises proxy traffic as standard HTTPS traffic, hard to distinguish from a real website
- Relies on a real domain certificate, with a slightly higher setup bar than SS
- Strong resistance to blocking, currently one of the more mainstream choices
Hysteria
- A next-generation protocol built on UDP/QUIC, with standout performance on poor networks
- Notably optimized for high-latency, high-packet-loss networks (like long-distance international lines)
- A relatively new ecosystem — not every client or provider supports it yet
SOCKS5 / HTTP
- The most basic general-purpose proxy protocol, with no built-in encryption
- Often used for forwarding between local programs, or paired with another encrypted tunnel
- Higher risk if exposed directly on the public internet — not recommended as a standalone protocol for bypassing restrictions
No single protocol is objectively "best" — the right choice usually depends on what your subscription provider offers and how sensitive your network environment is to certain traffic patterns. In everyday use, stability and line quality tend to matter more to your experience than the protocol itself.
Networking & DNS Terms
A database that maps IP address ranges to countries/regions. Clash uses it to power rules like GEOIP,CN,DIRECT, determining roughly which region an IP belongs to.
A DNS handling strategy: assign each domain a virtual IP, deferring actual resolution until a connection is established. It offers good compatibility and is the common default for TUN mode — see Advanced Configuration for details.
Tampering refers to an ISP or network device returning an incorrect resolution result, causing access to be hijacked or blocked; a leak refers to a domain resolution request that should have gone through the proxy instead being exposed directly to the local network's DNS server. Both are reasons proxy tools need to handle DNS specially.
Virtual network devices provided by the operating system. TUN operates at the network layer (forwarding IP packets), while TAP operates at the data link layer (forwarding Ethernet frames). Clash's TUN mode uses a TUN device — see Advanced Configuration for details.
Client-Related Terms
Modifying the operating system's proxy settings so that apps which read that setting forward their traffic to the port Clash is listening on. Simple to set up, but can't cover every program.
A batch of rules fetched from a remote URL and updated automatically, avoiding the need to hand-write and maintain hundreds or thousands of domain/IP rules — see Advanced Configuration for details.
Similar to Rule Provider, but fetches a batch of proxy nodes instead — commonly used to import all the nodes from a subscription into a single proxy group for unified scheduling.