Network Anonymity

Multi-layered network anonymity for red team operations -- proxy chains, VPN tunnels, Tor routing, traffic obfuscation, MAC/fingerprint hardening, DNS privacy, and comprehensive leak prevention. Every technique maps to trenton's four opsec profiles so operators can scale anonymity to their threat model.

Opsec Profile Integration

Each opsec profile prescribes a different anonymity posture. Read the relevant reference files for implementation details at each level.

Set the active profile before configuring anonymity layers:

node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" set <profile>
node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" show

Reference Files

Read these based on the task at hand. Each file is self-contained with actionable commands and configurations.

Workflow

1. Baseline Assessment

Before deploying anonymity layers, capture the current network identity so you can verify changes and detect regressions.

# Capture current network fingerprint
echo "=== Network Identity Baseline ==="
echo "Public IP: $(curl -s --max-time 5 https://api.ipify.org)"
echo "DNS Resolver: $(dig +short whoami.akamai.net 2>/dev/null || echo 'dig unavailable')"
echo "IPv6: $(curl -6 -s --max-time 5 https://api6.ipify.org 2>/dev/null || echo 'disabled/blocked')"
echo "Hostname: $(hostname)"
echo "MAC (primary): $(ip link show $(ip route show default | awk '/default/ {print $5}') | awk '/ether/ {print $2}')"

2. Layer Deployment Order

Deploy anonymity layers bottom-up. Each layer builds on the previous one.

Layer 0: MAC + hostname + fingerprint hardening  →  references/mac-and-fingerprint.md
Layer 1: VPN tunnel + killswitch                 →  references/vpn-killswitch.md
Layer 2: DNS privacy (encrypted DNS through VPN) →  references/dns-privacy.md
Layer 3: Tor / proxy chain on top of VPN         →  references/proxy-chain-setup.md
Layer 4: Traffic obfuscation (if DPI is a threat) →  references/traffic-obfuscation.md

Not every engagement needs all layers. The opsec profile determines which layers to deploy:

• loud: Skip all layers
• normal: Layer 1 only
• stealth: Layers 0-3
• paranoid: Layers 0-4

3. Verification

After deploying layers, run the leak test suite. See references/vpn-killswitch.md for the full test battery.

# Quick verification (run after every layer change)
echo "Exit IP: $(proxychains4 -q curl -s --max-time 10 https://api.ipify.org 2>/dev/null || curl -s --max-time 10 https://api.ipify.org)"
echo "DNS: $(proxychains4 -q dig +short whoami.akamai.net 2>/dev/null || dig +short whoami.akamai.net)"
echo "IPv6: $(curl -6 -s --max-time 5 https://api6.ipify.org 2>/dev/null && echo 'LEAK DETECTED' || echo 'blocked')"
echo "Tor: $(curl -s --max-time 10 https://check.torproject.org/api/ip 2>/dev/null | grep -o '"IsTor":[a-z]*')"

4. Continuous Monitoring

For stealth and paranoid profiles, schedule periodic leak checks during operations.

# Background leak monitor (runs every N seconds based on profile)
INTERVAL=1800  # stealth=1800, paranoid=300
while true; do
    IP=$(curl -s --max-time 10 https://api.ipify.org 2>/dev/null)
    DNS=$(dig +short whoami.akamai.net 2>/dev/null)
    IPV6=$(curl -6 -s --max-time 5 https://api6.ipify.org 2>/dev/null)
    [ -n "$IPV6" ] && echo "[ALERT] IPv6 leak detected: $IPV6"
    echo "[$(date +%H:%M:%S)] IP=$IP DNS=$DNS"
    sleep $INTERVAL
done

5. Teardown

Reverse the deployment order when ending operations. For paranoid profile, run anti-forensics cleanup afterward (cross-reference: anti-forensics skill).

Teardown order: Layer 4 → 3 → 2 → 1 → 0
- Remove proxy/Tor configuration
- Restore DNS settings (unlock resolv.conf)
- Disable killswitch, restore original firewall rules
- Restore original MAC and hostname
- Clear connection logs, bash history entries related to anonymity setup

Logging

Log all network anonymity operations for engagement records:

node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "network-anonymity" \
  --action "<action>" \
  --detail "<detail>"

Log identity changes (MAC, IP, hostname rotations):

node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" add \
  <type> <interface> <old-value> <new-value>

Cross-Skill References