XTLS/Xray-core · error

VLESS users: inbound's "reverse" can't have "sniffing"

Error message

VLESS users: inbound's "reverse" can't have "sniffing"

What it means

If a VLESS inbound user's 'reverse' object carries a 'sniffing' field, the config is rejected — sniffing is an inbound-level (stream-level) setting, not a per-user reverse option. The source comment notes this branch may be unreachable because JSON unmarshal may already fail, but the guard exists for safety.

Source

Thrown at infra/conf/vless.go:93

		case vless.XRV:
		default:
			return errors.New(`VLESS users: "flow" doesn't support "` + account.Flow + `" in this version`)
		}

		if len(account.Testseed) < 4 {
			account.Testseed = c.Testseed
		}

		if account.Encryption != "" {
			return errors.New(`VLESS users: "encryption" should not be in inbound settings`)
		}

		if account.Reverse != nil {
			if account.Reverse.Tag == "" {
				return errors.New(`VLESS users: "tag" can't be empty for "reverse"`)
			}
			if account.Reverse.Sniffing != nil { // may not be reached: error json unmarshal
				return errors.New(`VLESS users: inbound's "reverse" can't have "sniffing"`)
			}
		}

		user.Account = serial.ToTypedMessage(account)
		config.Users[idx] = user
		return nil
	}

	if err := task.ParallelForN(len(c.Users), processClient); err != nil {
		return nil, err
	}

	config.Decryption = c.Decryption
	if !func() bool {
		s := strings.Split(config.Decryption, ".")
		if len(s) < 4 || s[0] != "mlkem768x25519plus" {
			return false
		}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Remove "sniffing" from the reverse object
2. Configure sniffing at the inbound top level: "sniffing": { "enabled": true, "destOverride": ["http","tls"] }

Example fix

// before
"reverse": { "tag": "bridge", "sniffing": { "enabled": true } }
// after
"reverse": { "tag": "bridge" }  // sniffing belongs on the inbound, not here

if r := gjson.Get(clientRaw, "reverse"); r.Exists() {
    if gjson.Get(r.Raw, "sniffing").Exists() {
        return errors.New("reverse object must not contain \"sniffing\"; put sniffing on the inbound")
    }
}

When it happens

Trigger: "reverse": { "tag": "bridge", "sniffing": { "enabled": true } } on a client entry.

Common situations: Copying a whole inbound block (which contains sniffing) into the per-user reverse object when wiring up reverse proxying.

Related errors

• VLESS users: "tag" can't be empty for "reverse"
• VLESS reverse: invalid "sniffing" config
• bridge tag is empty
• bridge domain is empty
• portal tag is empty

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/3550d323415c18ff. Report an issue: GitHub.