Clash Glossary: 25 Essential Concepts

A lightweight proxy protocol built on symmetric encryption, in wide use since 2012. Client and server agree on a cipher and password, giving it a simple traffic signature and low overhead. Supported natively by every Clash core, with config field type: ss.

A transport protocol designed for the V2Ray project, using a UUID for authentication with support for dynamic encryption and multiplexing. It's sensitive to time sync — a large clock offset between client and server causes handshake failures. Deployments typically pair it with WebSocket and TLS to disguise the traffic.

A protocol that disguises proxy traffic as standard HTTPS access, relying on the server holding a valid TLS certificate so it looks like an ordinary website request. Configuration only needs a server domain, a port (usually 443), and a password, and it's natively supported by the mihomo core.

A streamlined successor to VMess that drops the built-in encryption layer, leaving security to an outer TLS or REALITY layer for lower handshake overhead. The classic Clash core doesn't recognize this type — subscriptions with VLESS nodes require a mihomo-based client.

A high-speed proxy protocol built on QUIC/UDP, using custom congestion control to improve throughput on lossy links — well suited to long, cross-border routes. Configuration needs a server password and bandwidth parameters, and it's supported only by the mihomo core.

A community-maintained fork of the Clash core, formerly named Clash Meta. It extends the original with support for protocols like VLESS and Hysteria2, plus rule sets, GeoSite, and enhanced TUN handling. Most mainstream GUI clients ship with this core by default.

The original open-source Clash core, discontinued and removed from its repository in 2023. It defined the YAML config format the current ecosystem still follows, but new protocols and features are no longer backported — configs and clients are best migrated to the mihomo lineage.

Graphical software that wraps a core, such as Clash Plus, Clash Verge Rev, and FlClash. It handles subscription management, node switching, and the system proxy toggle, while all actual traffic handling is done by the bundled core. See the downloads page for client options by platform.

The HTTP RESTful control interface exposed by the core, used by GUI panels to read the connection list, switch nodes, and reload configs. It listens on 127.0.0.1:9090 by default; set a secret field to require a token and keep other devices on the LAN from calling it.

The file format that carries Clash configs, using indentation to express hierarchy — spaces only, no tabs. Fields in config.yaml like port, proxies, and rules all follow YAML syntax; indentation mistakes are the top cause of config load failures.

A remote config URL provided by a service; the client fetches nodes and rules from it and refreshes on a schedule. Common formats are a full YAML config or a Base64-encoded node list — the latter can't be loaded by Clash directly and needs converting first.

A service or tool that converts generic share links or other client formats into Clash YAML. Used when migrating between clients, or when a subscription only provides a node list. The conversion process handles node data in transit, so self-hosting or a trusted instance is advisable.

A mechanism for splitting node lists out of the main config, importing them by URL or local file, with independently configurable update intervals and health checks. Well suited to merging multiple subscriptions and decoupling nodes from the main config; most complete under the mihomo core.

A mechanism for layering custom changes on top of a subscription without editing its original content — say, appending a few rules or replacing the DNS block. Overrides stay in effect after the subscription refreshes, so manual edits don't get wiped by the next update. See each client's override entry point and syntax in the config reference.

Clash's default operating mode (mode: rule): traffic is matched against the rules list from top to bottom, and the first hit executes its assigned policy. Common rule types include DOMAIN-SUFFIX, IP-CIDR, and GEOIP, with a MATCH rule as the catch-all at the end.

A container that organizes nodes and decides the actual outbound once a rule matches. Types include manual selection with select, auto speed-testing with url-test, fallback, and load-balance; groups can nest inside other groups to build multi-level routing.

A rule type that matches traffic by IP location, relying on a local MMDB geo database. A typical line is GEOIP,CN,DIRECT, sending connections that resolve to mainland China IPs straight through. The database needs updating along with the core or manually, or location matching goes stale.

A rule type that matches by domain category database, a mihomo-only feature. It packages tens of thousands of domain rules into category references like geosite:google, keeping the main config much shorter and letting category data update independently of the rules.

A Clash DNS response mode: a domain query first gets a fictitious IP within 198.18.0.0/16, which is mapped back to the real domain once a connection is established. This skips waiting on a real lookup, lowering first-packet latency, and also sidesteps some DNS poisoning that would otherwise interfere with routing.

A usable proxy server route, made up of a protocol type, server address, port, and authentication info. A subscription usually includes nodes across multiple regions, and proxy groups pick among them manually or auto-switch based on speed tests.

The round-trip time between client and node, measured in milliseconds. Clients typically measure it with a single HTTP request to a fixed test URL, and the value depends on route distance and congestion. Low latency doesn't mean high bandwidth — smooth video also depends on throughput.

An OS-level HTTP/SOCKS proxy setting; once enabled, traffic from apps that honor it flows into Clash's mixed port (7890 by default). Some programs don't read the system proxy setting, so their traffic is unaffected unless TUN mode takes over.

A scheme that intercepts all traffic at the network layer via a virtual network adapter, independent of whether an app honors the system proxy — it can cover CLI tools and game clients too. Enabling it requires administrator rights or a system extension grant, and the mihomo core has this built in.

The phenomenon where domain resolution still goes through the local ISP's DNS even with the proxy on — the destination request travels through an encrypted tunnel, but the lookup itself is exposed on the local network. Clash avoids this by taking over DNS queries, paired with fake-ip mode or an encrypted upstream (DoH/DoT).

The maximum transmission unit of a single network packet; a TUN virtual adapter commonly defaults to 1500. Too large a value causes packets to fragment and drop, showing up as flaky pages or interrupted large transfers. When troubleshooting odd behavior under TUN mode, try lowering the MTU to 1400 for comparison.