Hysteria2 Monitoring

Real-time uptime monitoring for Hysteria2 — the QUIC-based high-performance VPN. TunnelHQ performs real Hysteria handshakes, verifies auth, and tracks UDP connectivity across distributed regions. Sub-second alerts, REST API, free for 5 monitors.

Why Hysteria2 needs QUIC-aware monitoring

Hysteria2 is built on QUIC (HTTP/3's transport) rather than TCP. This gives it real performance advantages — 0-RTT connection setup, built-in congestion control (including Hysteria's famous Brutal algorithm), multiplexed streams, and native UDP relay. But it also means:

• Standard TCP port probes can't check a Hysteria2 server — it's listening on UDP
• QUIC handshakes are notoriously hard to reconstruct without a real QUIC stack
• Hysteria2 adds its own obfuscation (Salamander) on top of QUIC, which trips up naive monitors
• The server can be configured to "disguise" as an HTTP/3 website, further complicating detection

TunnelHQ performs the actual Hysteria2 client flow: QUIC handshake → Hysteria auth → stream open. Only a successful full exchange counts as "up".

URI auto-detection

Paste a standard hysteria2:// (or legacy hy2://) URI and TunnelHQ parses the full config:

hysteria2://[email protected]:443?
  sni=www.bing.com&
  obfs=salamander&
  obfs-password=mysecret&
  insecure=0#Production-Hy2

Extracted fields:

• Password (URL-decoded)
• Endpoint (server.example.com:443/udp)
• SNI for TLS handshake
• Salamander obfuscation password (if obfs=salamander is set)
• Insecure mode flag (for self-signed deployments)
• ALPN values (defaults to h3)

Common Hysteria2 failure modes TunnelHQ catches

• Password or obfs-password rotation not propagated to clients
• TLS certificate expiry (UDP/QUIC doesn't skip this)
• ISP UDP throttling or port-number-based filtering
• Server behind NAT losing its port binding after an idle period
• Hysteria process crashed but QUIC socket still held by the kernel briefly
• Masquerade target site cert expiry (when disguise is enabled)

Regional check nodes matter for Hysteria2

Hysteria2's killer feature — the Brutal congestion control — is designed to perform well across lossy, high-latency paths. That same property makes Hysteria2 deployments particularly susceptible to regional ISP-level UDP interference. TunnelHQ runs checks from US, EU, APAC, SA nodes so you can see whether a failure is a real server issue or a regional UDP-blocking event.

Pricing for Hysteria2 monitoring

FAQ

Does TunnelHQ support Hysteria 1 (legacy)?

Hysteria2 is the current maintained version. If you're still on Hysteria 1, migration is straightforward — TunnelHQ focuses on Hysteria2 which is what most active deployments use in 2026.

Does TunnelHQ measure Hysteria throughput?

We report latency and handshake time. Bandwidth measurement (which Hysteria is famous for optimizing) is on the roadmap — contact [email protected] if it's important for your use case.

Can I monitor Hysteria2 over WebSocket transport?

Hysteria2 is QUIC-native; WebSocket transport is not a standard feature of Hysteria2. If you're running Hysteria behind a TCP proxy (unusual), contact us.