How to ensure that proxifyre works as expected?

[Kierow]

Hello,

Firstly, I would like to thank you for the great job. It's amazing to have a such tool open source.

I have a little question. How can we ensure that all the traffic is well "socksified" ? What is the easiest solution to confirm that everything works as expected?
For example, for Edge, I can check that my public IP address is different. But for other apps, I don't really know how to confirm it.
I thought about Wireshark but not sure how I can monitor and validate this...

For information, I use the following app-config.json file:

{
 "logLevel": "All",
 "proxies": [
         {
         "appNames": [""],
         "socks5ProxyEndpoint": "127.0.0.1:1080",
         "supportedProtocols": ["TCP", "UDP"]
         }
     ]
}

Regards,

[wiresock]

Hello,

Thanks for the kind words — glad the tool is helpful! 🙏

Because redirection is performed at the NDIS (network driver) level, the process is fully transparent to the operating system and applications.
Tools like netstat, Resource Monitor, or browser IP checks only show what the OS sees — not the intermediate SOCKS step.

Wireshark on the same machine also won’t give you a clean answer:

• It will capture both locally generated packets (before redirection) and the re-injected packets (after SOCKS processing).
• The result is a confusing mix of “direct” and “proxied” traffic in the same capture — this is normal for this redirection method.

If you want to confirm that all traffic is going through SOCKS, you can:

1. Check the SOCKS5 server logs
   The most reliable method — you should see every connection listed there if redirection works correctly.

2. Capture traffic outside the host
   Use a packet capture on your router, gateway, or a switch with port mirroring.
   If redirection works, you’ll only see the proxy’s outbound connections, not direct ones from the original apps.

3. Controlled test server
   Connect to a server you control and check which IP address arrives.
   If you see the proxy’s IP, it’s being socksified.

Any on-host inspection will be misleading because the NDIS-level driver works below where those tools observe traffic.

Regards,
Vadim