Hysteria2

Hysteria2 is the connection mode Colitu Adaptive Connect tries first in every app. It is built for speed and makes the biggest difference on networks that lose a lot of packets.

#What is Hysteria2?

Hysteria2 is a UDP-based proxy protocol developed by the open source apernet project. It carries traffic over QUIC and encrypts it with TLS 1.3. Every Colitu server has Hysteria2 ready.

#Why Colitu uses it

• It doesn't slow down as sharply as TCP-based protocols when packets get lost.
• It copes better with the ups and downs of mobile networks.
• It runs with a real TLS certificate; from the outside it is encrypted QUIC traffic.

That's why it is the first choice whenever your network allows UDP.

#How it works over UDP and QUIC

TCP-based protocols deliver data as a single ordered line: if one packet is lost, everything behind it waits for the resend. QUIC runs on UDP and carries several independent streams inside one connection, so a packet lost in one stream doesn't hold up the others. Setting up the connection and the TLS 1.3 encryption happen together in the same handshake.

#The advantage on lossy networks

TCP treats every lost packet as a sign of congestion and cuts its speed straight away. On wireless links and over long distances, though, packets are often lost to signal and line problems rather than congestion. Hysteria2 uses a "Brutal"-style congestion control: instead of halving its rate when packets go missing, it compensates for the loss and tries to hold the target speed. The result is steadier speed on lossy connections.

#The advantage on mobile connections

On mobile networks the signal strength changes, your phone hands over between cell towers and latency jumps around at busy times. All of this causes packet loss. Thanks to Hysteria2's loss-tolerant design and QUIC's independent streams, page loads, video and voice calls are less affected by these swings.

#When Adaptive Connect prefers it

Hysteria2 is the first mode tried in the Windows, Android, iOS and Linux apps. If it passes the health check, meaning real traffic flows through the tunnel, your connection runs on Hysteria2.

One exception: Android remembers the last mode that worked on each server. If a different mode worked there before, the next connection starts with that mode.

#What if Hysteria2 (UDP) is blocked?

Some office, hotel and school networks, and some mobile carriers, block or throttle UDP traffic. Then Hysteria2 fails the health check and Colitu switches to the TCP-based modes automatically:

• Android and iOS: the next mode is VLESS Reality.
• Windows and Linux: the TCP mode that answers the server fastest is tried. A Hysteria2 connection that carried no traffic goes to the end of the line for 10 minutes, so reconnecting doesn't run into the same block again.

You don't need to change any setting. More detail: How Colitu Adaptive Connect works

#Security and encryption

• All traffic is encrypted with TLS 1.3.
• Servers use a real TLS certificate obtained automatically (ACME), not a self-signed one.
• Server addresses, ports and keys are not published; they reach your app encrypted.

For the technical deep dive: colitu.com/protocols/hysteria2