Excessive TIME_WAIT Connections When Using HTTPS Fronting with CDN in Sliver C2

[pythonSB]

I found that in Sliver C2, when using HTTPS and a fronting domain protected by Cloudflare, the system sequentially connects to the domain every time a session is switched. Since the domain is behind a CDN, each connection often resolves to a different IP address, which leads to a buildup of TIME_WAIT sockets. How can I solve this problem?

In my opinion, session switching — which relies on long-lived connections — should use mTLS (mutual TLS) for a truly persistent connection, instead of relying on sleep-based polling. HTTPS is more suitable for beacon-style communication.

[pythonSB]

Option 1: DNS Caching / IP Pinning
If you maintain the Sliver client or can modify its configuration, caching the first resolved Cloudflare IP and reusing it is a practical strategy.

In Go (or any language), you can use a custom DNS resolver or dialer.

Once the IP is resolved, subsequent requests should reuse that IP until failure, at which point a new resolution can occur.

Option 2: Use mTLS for Long-Lived Sessions
You're absolutely right:

HTTPS is not suitable for long-lived C2 connections; it's better for short-lived beaconing. Long-lived sessions should use mTLS.

✅ Reasons:

HTTPS connections are often intercepted or disrupted by CDN (e.g., WAF, throttling, changing IPs).

mTLS allows stable, persistent connections through a more reliable channel.

Reduces system overhead and excessive TIME_WAIT states.

Supports server push, asynchronous RPC, and other long-session capabilities.

🚀 If Sliver supports configuring an mtls listener and compatible client, you should consider switching to that setup.

[pythonSB]

interactive -m, --mtls string mtls connection strings .....smile