GLOSSARY

Clash Glossary

Terms you'll run into repeatedly while using Clash clients, organized into five quick-reference categories. Each entry gives a concise definition plus the practical details that matter in real use - pair this with the setup guide and technical reference for faster reading.

A · PROTOCOL

Proxy Protocols

The transport protocol type behind a node entry's type field. The protocol determines encryption method, handshake behavior, and core compatibility - see the technical reference for selection guidance.

Proxy ProtocolsShadowsocks (SS): A lightweight encrypted proxy protocol, essentially a SOCKS5 variant built on symmetric encryption. Simple structure, low handshake overhead, low resource usage, and battery-friendly on mobile. Supported natively by nearly every Clash core and client, making it the most broadly compatible protocol type.
Proxy ProtocolsVmess: A proxy protocol designed by the V2Ray project, authenticated via a user ID (UUID) and supporting transport encapsulations like WebSocket and gRPC. Has more configuration fields, and parameters such as alterId and the encryption method must match exactly between client and server, or the connection fails outright.
Proxy ProtocolsTrojan: A protocol that transmits proxy traffic disguised as standard TLS traffic, with a handshake that closely resembles regular HTTPS. Few configuration fields are needed - just server address, port, and password - but it has a strict requirement for a valid server certificate; an expired certificate or domain mismatch will cause the handshake to fail.
Proxy ProtocolsVLESS: A streamlined successor to Vmess that removes the built-in encryption layer, relying entirely on an outer TLS layer for security, resulting in lower protocol overhead. The original Clash core does not support this protocol - any subscription containing VLESS nodes requires a client built on the mihomo core.
Proxy ProtocolsHysteria2: A QUIC (UDP)-based proxy protocol with an aggressive built-in congestion control algorithm, delivering noticeably better throughput than TCP-based protocols on high-packet-loss, high-latency links. Supported only by the mihomo core; it becomes entirely unusable on networks that restrict UDP.
Proxy ProtocolsTUIC: Another QUIC-based proxy protocol focused on low handshake latency (0-RTT) and native UDP forwarding, well suited to gaming and real-time communication. Requires the mihomo core along with server-side support for the protocol, and is less widely adopted than Hysteria2.

B · CORE & CLIENT

Cores & Clients

The "core" handles forwarding and rule matching; the "client" handles the graphical interface - two distinct roles. See the downloads page and side-by-side comparison for choosing a client.

Cores & ClientsCore: The command-line program that actually performs proxy forwarding, rule matching, and DNS handling, with no graphical interface of its own. A GUI client is essentially a graphical shell around the core - the range of supported protocols, TUN capability, and other feature ceilings are determined by the core version, not the interface.
Cores & Clientsmihomo (Clash Meta): A community-maintained fork of the Clash core, formerly known as Clash Meta. It extends the original with support for protocols such as VLESS, Hysteria2, and TUIC, plus built-in TUN mode and enhanced rule sets (rule-providers). It is now the default core for most mainstream clients.
Cores & ClientsGUI Client: An application that provides a graphical interface for the core, handling subscription management, node switching, system proxy toggles, launch-on-startup, and other interactions - for example, Clash Plus, Clash Verge Rev, and FlClash. Different clients can run the same core and behave identically in terms of routing.
Cores & ClientsClash for Windows (CFW): Once the dominant Windows desktop client, discontinued in 2023. It runs the original core and does not support newer protocols like VLESS or Hysteria2, so compatibility with new subscriptions keeps declining - migrating to a client built on the mihomo core is now recommended.
Cores & ClientsExternal Controller (RESTful API): A local HTTP management interface exposed by the core, listening on port 9090 by default. GUI panels use it to read connection lists, switch nodes, and view traffic. Third-party web panels rely on the same interface, controlled via the external-controller field in the configuration.

C · CONFIG & RULE

Configuration & Rules

The configuration file is Clash's behavioral contract: where nodes come from and where traffic goes are both decided here. See the setup guide for the full steps to import a subscription for the first time.

Configuration & RulesSubscription: A configuration distribution link provided by a service; the client fetches it on a fixed schedule to obtain the latest node list and rules. This is the main way to keep configuration consistent across multiple devices - a broken or expired link will cause updates to fail, leaving the node list stuck in an outdated state.
Configuration & RulesConfiguration File (YAML): Clash describes listening ports, DNS policy, nodes, proxy groups, and rules using YAML. YAML is indentation-sensitive, with hierarchy expressed through spaces - mixing in tabs or misaligning indentation will cause the core to fail parsing and refuse to start.
Configuration & RulesRule-Based Routing: A mechanism that routes traffic to different exits based on conditions like domain, IP range, or process name. Rules are matched top-down, stopping at the first match, with a final MATCH entry as a catch-all. This is the core capability that distinguishes Clash from simple global-proxy tools.
Configuration & RulesProxy Group: Organizes multiple nodes into a single selectable logical unit, with rules pointing to a proxy group rather than an individual node. Common types: select (manual choice), url-test (automatically picks the lowest-latency node), and fallback (switches in order on failure).
Configuration & RulesGlobal Mode: A running mode that bypasses all routing rules, sending all traffic through the currently selected exit - alongside rule mode and direct mode. Global mode is useful for temporary troubleshooting; rule mode is recommended for everyday use.
Configuration & RulesFake-IP: A DNS handling mode: domain queries immediately receive a virtual IP from the reserved 198.18.0.0/16 range, and the real domain is restored for rule matching once a connection is actually established. This skips the wait for real resolution and significantly reduces first-connection latency, as opposed to Redir-Host mode.
Configuration & RulesRule Provider: Splits large batches of rule entries into remotely updatable external files, with the configuration referencing only the set's name. The mihomo core supports domain, ipcidr, and classical formats, and rule sets can update automatically on their own schedule, independent of the subscription.

D · NETWORK

Network Basics

Understanding these underlying concepts saves time when troubleshooting "can't connect" or "abnormal speed test" issues. See common issues for a systematic troubleshooting path.

Network BasicsNode (Proxy): A single usable remote proxy server entry, containing the server address, port, protocol type, and authentication parameters - the basic unit of subscription content. The same node should behave consistently across clients; if it only fails on one device, the problem is likely local.
Network BasicsLatency: The time from when the client sends a test request to a node until a response is received, measured in milliseconds, reflecting round-trip time on the link. Latency and download bandwidth are two separate metrics: low latency doesn't guarantee fast speeds, and high latency doesn't necessarily hurt large-file throughput.
Network BasicsDNS (Domain Resolution): The underlying service that translates domain names into IP addresses. Clash's built-in DNS module can take over resolution, supporting encrypted lookup methods like DoH and DoT; the nameserver and fallback fields in the configuration define the regular and backup resolution sources.
Network BasicsDNS Leak: A situation where the proxy is already active, but domain resolution requests are still sent directly to the local ISP's DNS, which can expose browsing intent and sometimes return inaccurate results. The usual fix is enabling Fake-IP mode or TUN mode so resolution also passes through Clash.
Network BasicsGeoIP: A database mapping IP addresses to countries/regions. Rule entries like GEOIP,CN,DIRECT rely on it to determine the destination IP's location; an outdated database can cause misclassification, so it's worth updating alongside the core or manually refreshing the data file in the client.
Network BasicsUDP Forwarding: The proxy link's ability to carry UDP packets, heavily relied upon by online gaming and voice/video calls. It requires the node's protocol to support UDP itself (e.g. Shadowsocks's udp parameter, or Hysteria2's native support) and the server to have it enabled - if either piece is missing, the related app can only connect directly.

E · RUNTIME

Runtime & Debugging

A few of the most frequently asked-about toggles in the client's settings panel. Once you understand each one, cross-reference the troubleshooting categories for specific error messages.

Runtime & DebuggingTUN Mode: A running mode that intercepts all traffic at the system network layer via a virtual network adapter, covering programs that don't read system proxy settings (command-line tools, some game clients). Enabling it requires administrator privileges or a system extension grant; the original core needs a helper component, while mihomo has it built in natively.
Runtime & DebuggingSystem Proxy: A toggle that writes the proxy address into the operating system's network settings so that applications respecting this setting send traffic to Clash's local port. Browsers generally comply; command-line tools like curl and git ignore it by default, requiring separate environment variables or TUN mode instead.
Runtime & DebuggingMixed Port: A local listening port that accepts both HTTP and SOCKS5 protocol connections, commonly defaulting to 7890. When manually configuring a proxy in other software, just enter 127.0.0.1 as the address and this value as the port - no need to distinguish proxy types.
Runtime & DebuggingLog Level: A setting that controls how detailed core logs are, increasing in order from silent, error, warning, info, to debug. Temporarily raise it to info or debug when troubleshooting a connection issue to see which rules and exits are being matched, then lower it again afterward to keep log files from growing unbounded.
Runtime & DebuggingLaunch on Startup: An option that runs the client automatically when the operating system starts, usually paired with "silent startup" so it stays minimized in the tray after boot. On Windows, if TUN mode is also enabled, autostart must register a scheduled task with administrator privileges, or the virtual network adapter will fail to create.
Runtime & DebuggingLatency Test (URL Test): A feature where the client sends an HTTP request to a specified test URL to measure a node's response time; the test URL and timeout threshold can be customized in the configuration. Proxy groups of type url-test automatically select the lowest-latency node based on these results.

Next Steps

Once you've looked up the terms, get back to practice: grab an installer for your platform on the downloads page, walk through importing a subscription and verifying connectivity on the setup guide, and dig into protocol and core comparisons in the technical reference.

Download Clash View Guide