Enhanced Mode

The local HTTP/SOCKS5 port only sees applications that you configure to use it. Enhanced Mode routes connections from every application on the machine, using the same [rule].list.

[enhanced-mode]
enable = true
type = "ebpf"        # Linux
ip-version = "ipv4"

Which backend

Platform	type	How it captures	Page
Linux	ebpf	cgroup socket hooks; knows the process of every connection; no virtual interface	Linux eBPF
macOS, Windows	tun	a virtual network interface	TUN

On Linux, type = "tun" is rejected: enhanced-mode.type=tun is not supported on Linux; use ebpf or disable enhanced mode.

Fields

Field	Default	Notes
enable	false	turn Enhanced Mode on
type	"tun"	ebpf or tun, see above
ip-version	"ipv4"	ipv4, ipv6 or dual; the eBPF backend currently captures IPv4 only

Backend-specific tables: [enhanced-mode.ebpf] on Linux eBPF, [enhanced-mode.tun] on TUN. Any other key directly under [enhanced-mode] is rejected.

Before you enable it

1. Make the profile work without Enhanced Mode first: Direct, then Global, then Rule, all through the local port. See Quick Start.
2. Enhanced Mode needs elevated privileges. On Linux, run Core with sudo or as a systemd service.
3. Domain rules need DNS for captured traffic. The defaults work; read DNS before changing [dns.tun].
4. Know how to stop it. Stop Core normally (Ctrl+C, systemctl stop, or quitting the app) so it can undo its changes. Do not use kill -9.

Sniffer

For captured TCP connections Core can read the HTTP Host header or the TLS SNI to learn the destination name, and use it for domain rules. It is on by default. See Sniffer.