Every request leaving a device carries more identifying detail than most people expect. The IP address is only the surface layer. Underneath sit packet-level quirks, header ordering, and timing patterns that servers read without asking permission.
Checking what actually goes out isn’t complicated, and it takes maybe ten minutes with free tools. The results tend to surprise anyone who assumed a VPN handled everything. And knowing where the gaps are is the only way to close them.
Start With the Obvious Layer
The IP address is the first thing any site logs. It maps to a rough geographic area, an autonomous system number, and the network operator behind it. Public lookup tools return all three in about a second.
DNS is where things get messier. A device can route web traffic through a proxy while still sending DNS queries to the internet provider’s resolver, which quietly exposes the real network underneath. Leak tests catch this by resolving randomized subdomains and reporting which servers answered.
WebRTC creates a similar problem inside the browser. The API was built for peer-to-peer calls, so it collects local and public addresses through STUN servers, and unpatched configurations hand those to any page that asks for them.
Both checks take seconds. Chrome, Firefox, and Safari all handle STUN requests slightly differently, so results can vary by browser on the same machine.
The Network Stack Nobody Checks
Below the browser sits the TCP/IP stack, and it’s chatty. Operating systems differ in TCP window size, TTL defaults, maximum segment size, and the exact ordering of TCP options. Running a connection through IPRoyal’s test fingerprint online service shows which values the stack broadcasts and whether they line up with what the browser claims.
But that mismatch matters more than the raw numbers. Passive OS detection, documented in the reference material on TCP/IP stack fingerprinting, lets a server compare what the packets say against what the User-Agent header claims. A Windows user agent riding on a Linux signature is a contradiction, and anti-bot systems treat contradictions as strong evidence.
TLS adds another layer. The cipher suites offered, the extension order, and the ALPN values form a handshake signature (JA3 and JA4 are the common formats) that stays consistent across sessions even when the IP changes.
The Browser’s Own Signals
Above the network layer, JavaScript exposes a long list of attributes: screen dimensions, installed fonts, hardware concurrency, timezone offset, and canvas and WebGL rendering output. Individually these are dull. Combined, they’re often unique across millions of visitors.
The EFF’s Cover Your Tracks project measures exactly this and reports how many bits of identifying information a browser gives away. Most desktop configurations score somewhere between 15 and 20 bits, which is enough to single out one machine in a pool of hundreds of thousands.
Timezone mismatches deserve special attention. A browser reporting Central European Time while connecting from a Chicago IP is the kind of inconsistency that gets flagged instantly, and it’s one of the most common mistakes in proxy setups.
Reading the Results
Not every leak needs fixing. A researcher scraping public pricing pages has different requirements than someone accessing a bank account from a hotel network, and hardening everything to maximum tends to make a connection stand out rather than blend in.
The W3C’s guidance on mitigating browser fingerprinting puts it plainly: reducing the surface is useful, but perfectly uniform behavior is itself a signal. Tor Browser accepts that tradeoff on purpose. Most other setups shouldn’t.
A practical sequence works better. Run an IP and DNS check first, then WebRTC, then the stack-level test, then a browser fingerprint scan, and note only the values that contradict each other. Contradictions cause blocks; uniqueness alone usually doesn’t.
Write the findings down. A screenshot of clean output is worth having when something breaks three weeks later and nobody remembers what the baseline looked like.
Where This Goes Next
Detection keeps moving down the stack. Browser-level countermeasures got good enough that vendors shifted attention to TLS and TCP signatures, which are harder to spoof because they live in the operating system rather than the application.
Anyone running automation, testing geo-specific content, or just curious about their own exposure benefits from checking these layers on a schedule rather than once. Stacks change with every OS update, and a configuration that passed cleanly in March can start throwing mismatches by autumn.