WhoisThat
Classified
Case File№WT-0.7.0Status: Active

WhoisThat

A modern terminal-based VPN client.

Rust TUI frontend. Go engine backed by Xray-core. Built in the open under the MIT license.

Read the dossier→View on GitHub
Version
0.7.0
License
MIT
Protocols
6
Root required
No
§ 01Subject Profile

A terminal VPN client that doesn't trust you to read its source.

WhoisThat is a modern, terminal-based VPN client for Linux. A Rust TUI talks to a Go daemon over a length-prefixed JSON protocol on localhost. The daemon launches Xray-core as a subprocess and controls a TUN device through file capabilities — no root, no setuid, no sudo.

Profiles, groups, routing rules, and subscription metadata are stored encrypted at rest with AES-256-GCM. The TUI never touches the network. All VPN logic lives in the core.

Subject Sheet
Project
WhoisThat
Class
VPN client
Platform
Linux
Frontend
Rust · ratatui
Engine
Go · Xray-core
TUN
tun2socks
Encryption
AES-256-GCM
License
MIT
§ 02Known Aliases · Protocols
VLESSALIAS
VLESS
Reality · xHTTP · gRPC · WS · TCP
RealityxHTTPVision
VMESSALIAS
VMess
AES-128 / Zero AEAD
VMessAEAD
TROJANALIAS
Trojan
TLS-based proxy protocol
TrojanTLS
SSALIAS
Shadowsocks
AEAD ciphers
ShadowsocksSS
SOCKS5ALIAS
SOCKS5
Classic SOCKS5 outbound
SOCKS5SOCKS
HY2ALIAS
Hysteria2
QUIC-based high-throughput
Hysteria2hy2://
// Subject known to operate under multiple identities. All considered active.
§ 03Modus Operandi · Architecture

Three layers. The TUI never touches the network. The core speaks a custom TCP/JSON protocol on localhost. Xray-core handles all protocol-level work as a subprocess.

01
TUI
WhoisThat TUI
Terminal interface. Renders profiles, logs, routing, settings. Never touches the network directly.
Lang Rust
Stack ratatui + crossterm
Port —
02
CORE
WhoisThat Core
Long-running VPN engine. Manages profile DB, launches Xray, controls TUN, broadcasts state.
Lang Go
Stack TCP/JSON daemon
Port 127.0.0.1:4897
03
XRAY
Xray-core
Protocol-level work: handshakes, Reality, transport, SOCKS5 local proxy. Config generated on-the-fly.
Lang Go
Stack subprocess
Port SOCKS 3090 / HTTP 3091
Data flow · 4-byte big-endian length prefix + JSON payload
TUI
WhoisThat TUI
Rust · ratatui
Terminal interface
TCP/JSON · localhost:4897
CORE
WhoisThat Core
Go · daemon
VPN engine
subprocess · stdin JSON
XRAY
Xray-core
VLESS · Reality
SOCKS5 :3090 / HTTP :3091
↓ TUN device · tun2socks · iptables / nftables
§ 04Evidence · Features
F-01Exhibit

Subscription support

Add groups with subscription URLs, refresh profiles, view metadata — traffic used, limit, expiry.

F-02Exhibit

HWID device identification

Auto-generated hardware ID sent with subscription requests. Remnawave-compatible x-hwid headers. Toggle, reset, customize.

F-03Exhibit

Custom routing rules

Domain, IP, protocol, port → proxy / direct / block. GeoIP and GeoSite support. Auto-downloaded dat files.

F-04Exhibit

Kill-switch

When enabled, blocks all non-VPN traffic if the connection drops. Dedicated firewall table. SOCKS and TUN modes.

F-05Exhibit

Full TUN-mode VPN

tun2socks + iptables/nftables, auto-detected. No root required — runs under Linux file capabilities.

F-06Exhibit

Profile testing

Three methods: TCP connect, HTTP GET via SOCKS5, HTTP HEAD. Scan-all with dedup across all groups.

F-07Exhibit

Encrypted profile DB

AES-256-GCM at rest. Key auto-generated on first run. Transparent read/write, automatic migration.

F-08Exhibit

Detach / reattach

q leaves the VPN running in the background. Reopen the TUI to reattach. Autoconnect on startup.

Full dossier →
§ 05Surveillance · Terminal Intercept

The subject in its native environment. Tokyo Night-inspired palette. Keyboard-driven. Mouse optional.

Frame 01 · Live captureREC ●
WhoisThat TUI — terminal VPN client interface showing profiles, details, and bottom bar
~/profiles · v0.7.0Tokyo Night palette
§ 06Field Manual · Installation
M-01Method
Quick install
Any Linux distribution
curl -fsSL https://raw.githubusercontent.com/kvunoff/whoisthat/main/install.sh | bash

Auto-detects distro, builds from latest tagged release, installs to /usr/local/bin. Xray-core included.

M-02Method
Arch Linux (AUR)
paru / yay
paru -S whoisthat

Also: yay -S whoisthat. pkgrel handled automatically by CI on tag push.

M-03Method
Manual build
Rust 1.80+ · Go 1.24+ · git · curl · C compiler
git clone https://github.com/kvunoff/whoisthat.git
cd whoisthat
cd parser && cargo build --release && cd ..
cd core/core && go build -o whoisthat-core && cd ../..
cargo build --release

TUN mode: sudo setcap cap_net_admin,cap_net_raw,cap_setpcap=+ep /usr/local/bin/whoisthat-core

Open Source · MIT

Built in the open.

No telemetry. No tracking. No proprietary blobs. Source on GitHub under the MIT license. Contributions, issues, and forks welcome.

View sourceFork it
Declassified · For public release
FILE: whoisthat · LICENSE: MIT · ████████ · NO RIGHTS RESERVED