dae moves traffic decisions into the Linux kernel
dae is a transparent proxy for Linux hosts and routers. Its rules can split traffic by process name on the local machine, MAC address on the LAN, destination, domain, protocol, and inverted matches. Proxy groups can select nodes using measured connection latency. DNS has its own request and response routing, which lets an operator keep name resolution and connection policy in the same configuration.
The distinguishing mechanism is eBPF. Direct connections can remain on a kernel path instead of passing through a user-space proxy forwarder. That design is appealing on a router where most local traffic should stay direct and selected destinations should use a proxy. We did not measure throughput or resource use, so the project's performance claims should be tested with your traffic mix, network interfaces, and kernel.
The 22-second npm install only checked documentation tools
Our sandbox cloned commit b59e375 and installed 501 npm packages in 22 seconds. Those packages occupied 79 MB. The repository's package.json contains Markdown linting and link-check commands; dae itself is a Go project with C code for its kernel path. The npm result therefore describes the documentation toolchain, not an installation of the proxy daemon.
There was no npm build script and no npm test script, so both lab steps were skipped. We did not compile Go, load an eBPF program, change routes, or send traffic through a proxy node. That distinction matters because a clean JavaScript install can look like setup success while leaving the product's important code untouched. The 36 MB checkout contained 643 files and about 131,972 lines of source.
What happened when we ran it
Our 3-CPU, 8 GB Debian container completed the npm install in 22 seconds and had no build or test target to execute. Npm audit reported 27 known vulnerabilities in the 501-package tree: 1 critical, 17 high, 7 moderate, and 2 low. Those dependencies support documentation checks, so the audit is maintenance debt in the repository toolchain rather than evidence of an exploitable flaw in dae's running Go binary.
The checkout had 17 CI workflow files, a Dockerfile, and a Compose file. It did not have a tests directory. Go projects often keep tests beside implementation files, so that directory signal alone does not establish that dae lacks tests. The important limitation is simpler: our supplied run never invoked them. No build time, test count, or routing result can be claimed for the daemon from this sandbox record.
Linux 5.17 is a floor, not a compatibility guarantee
The English quick start requires kernel 5.17 for binding LAN or WAN traffic and 5.15 for dae trace. It also lists BPF, BPF JIT, BTF debug information, cgroups, kprobes, and traffic-control options that the kernel must expose. Mainstream desktop distributions commonly include them. Embedded distributions may remove some to save space, which is why an apparently recent kernel can still be unsuitable.
Two current reports show both sides of that problem. Issue 1126 says an RK3528 Armbian device on kernel 6.1.115 could not proxy traffic even though the same configuration worked on a newer x86 host. Issue 1127 records an eBPF CO-RE relocation failure on Linux 7.2.7 caused by a BTF header error. A version number clears the first check; a real start and traffic test on the target kernel clears the useful one.
Installation packages do not remove network ownership
The documentation covers APT and RPM repositories, Arch packages, NixOS, Gentoo, Alpine, Docker, an installer, and source builds. A packaged systemd service reads configuration from /etc/dae. English and Chinese manuals include a minimal idle configuration plus examples for interfaces, proxy subscriptions, DNS upstreams, groups, and routing rules. The breadth is good, especially for a networking tool where one copied interface name can cut off access.
A working setup still needs choices the installer cannot make. You choose the LAN or WAN interface, decide how DNS requests leave the box, add proxy nodes or subscription URLs, and define a direct fallback. The README specifically warns operators running a UDP server on the same public host to add a must_direct rule for its source port. Remote changes should have console access or another rollback path.
Configuration validation can still miss a startup failure
Open issue 1119 documents a narrow but important gap in dae validate. Malformed fixed_domain_ttl entries can pass the check, then stop dae run when the value is parsed during control-plane creation. The report includes empty, missing, and nonnumeric TTL examples. Until that path is fixed, validation should be followed by a supervised service start and checks for DNS, direct traffic, and proxied traffic.
Release v2.1.1 arrived on September 18, 2026, with a datapath and control-plane rework, DNS fixes, a WAN egress fix, updated outbound code, and rewritten English and Chinese manuals. GitHub recorded another push on September 25. The repository had 6,243 stars and 135 open issues and pull requests when fetched, which pairs current maintenance with a sizable support surface.
The right buyer has a test router and a rollback route
dae gives experienced Linux operators unusually precise control over where traffic travels. The cost is that its most interesting behavior depends on kernel facilities, network topology, DNS choices, and configuration details that our 501-package npm install never touched. A spare router, a representative client, and scripted checks for TCP, UDP, and DNS are better evaluation tools than a successful package install.
Choose dae when eBPF-based traffic splitting is the reason for the project, not a technical decoration. Keep the old service and configuration ready until v2.1.1 starts cleanly on the actual kernel and your direct routes remain direct. If you mainly want to paste a subscription into a desktop interface, v2rayA or another managed client will ask less of you.