diff --git a/Cargo.lock b/Cargo.lock
index 2382e28c4e..cc6077803a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4058,6 +4058,7 @@ version = "0.1.0"
 dependencies = [
  "nym-crypto",
  "nym-sphinx-types",
+ "serde",
  "thiserror",
 ]
 
diff --git a/clients/native/src/client/config/mod.rs b/clients/native/src/client/config/mod.rs
index 81ae097536..79d160d58e 100644
--- a/clients/native/src/client/config/mod.rs
+++ b/clients/native/src/client/config/mod.rs
@@ -94,6 +94,11 @@ impl Config {
         }
     }
 
+    pub fn validate(&self) -> bool {
+        // no other sections have explicit requirements (yet)
+        self.base.validate()
+    }
+
     pub fn with_socket(mut self, socket_type: SocketType) -> Self {
         self.socket.socket_type = socket_type;
         self
diff --git a/clients/native/src/commands/run.rs b/clients/native/src/commands/run.rs
index ef7a488289..b4155101f7 100644
--- a/clients/native/src/commands/run.rs
+++ b/clients/native/src/commands/run.rs
@@ -112,6 +112,10 @@ pub(crate) async fn execute(args: &Run) -> Result<(), Box<dyn Error + Send + Syn
         }
     };
 
+    if !config.validate() {
+        return Err(Box::new(ClientError::ConfigValidationFailure))
+    }
+
     let override_config_fields = OverrideConfig::from(args.clone());
     config = override_config(config, override_config_fields);
 
diff --git a/clients/native/src/error.rs b/clients/native/src/error.rs
index 5a8c0c1496..59d022999a 100644
--- a/clients/native/src/error.rs
+++ b/clients/native/src/error.rs
@@ -11,6 +11,10 @@ pub enum ClientError {
     #[error("Failed to load config for: {0}")]
     FailedToLoadConfig(String),
 
+    // TODO: add more details here
+    #[error("Failed to validate the loaded config")]
+    ConfigValidationFailure,
+
     #[error("Failed local version check, client and config mismatch")]
     FailedLocalVersionCheck,
 
diff --git a/clients/socks5/src/commands/run.rs b/clients/socks5/src/commands/run.rs
index 12ad0a658a..a559a1b408 100644
--- a/clients/socks5/src/commands/run.rs
+++ b/clients/socks5/src/commands/run.rs
@@ -122,6 +122,10 @@ pub(crate) async fn execute(args: &Run) -> Result<(), Box<dyn std::error::Error
         }
     };
 
+    if !config.validate() {
+        return Err(Box::new(Socks5ClientError::ConfigValidationFailure))
+    }
+
     let override_config_fields = OverrideConfig::from(args.clone());
     config = override_config(config, override_config_fields);
 
diff --git a/clients/socks5/src/error.rs b/clients/socks5/src/error.rs
index ec541cf1a5..0005cadf8d 100644
--- a/clients/socks5/src/error.rs
+++ b/clients/socks5/src/error.rs
@@ -8,6 +8,10 @@ pub enum Socks5ClientError {
     #[error("Failed to load config for: {0}")]
     FailedToLoadConfig(String),
 
+    // TODO: add more details here
+    #[error("Failed to validate the loaded config")]
+    ConfigValidationFailure,
+
     #[error("Failed local version check, client and config mismatch")]
     FailedLocalVersionCheck,
 
diff --git a/common/client-core/src/config/mod.rs b/common/client-core/src/config/mod.rs
index 635fadc533..4f09676d3b 100644
--- a/common/client-core/src/config/mod.rs
+++ b/common/client-core/src/config/mod.rs
@@ -32,6 +32,8 @@ const DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT: Duration = Duration::from_millis(5_00
 // bandwidth bridging protocol, we can come back to a smaller timeout value
 const DEFAULT_GATEWAY_RESPONSE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
 
+const DEFAULT_COVER_TRAFFIC_PRIMARY_SIZE_RATIO: f32 = 0.70;
+
 // reply-surbs related:
 
 // define when to request
@@ -90,6 +92,11 @@ impl<T> Config<T> {
         Config::default().with_id(id)
     }
 
+    pub fn validate(&self) -> bool {
+        // no other sections have explicit requirements (yet)
+        self.debug.validate()
+    }
+
     #[must_use]
     pub fn with_id<S: Into<String>>(mut self, id: S) -> Self
     where
@@ -616,16 +623,41 @@ pub struct Traffic {
     /// poisson distribution.
     pub disable_main_poisson_packet_distribution: bool,
 
+    /// Specifies the packet size used for sent messages.
+    /// Do not override it unless you understand the consequences of that change.
+    pub primary_packet_size: PacketSize,
+
+    /// Specifies the optional auxiliary packet size for optimizing message streams.
+    /// Note that its use decreases overall anonymity.
+    /// Do not set it it unless you understand the consequences of that change.
+    pub secondary_packet_size: Option<PacketSize>,
+
     /// Controls whether the sent sphinx packet use a NON-DEFAULT bigger size.
+    #[deprecated]
     pub use_extended_packet_size: Option<ExtendedPacketSize>,
 }
 
+impl Traffic {
+    pub fn validate(&self) -> bool {
+        if let Some(secondary_packet_size) = self.secondary_packet_size {
+            if secondary_packet_size == PacketSize::AckPacket
+                || secondary_packet_size == self.primary_packet_size
+            {
+                return false;
+            }
+        }
+        true
+    }
+}
+
 impl Default for Traffic {
     fn default() -> Self {
         Traffic {
             average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
             message_sending_average_delay: DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
             disable_main_poisson_packet_distribution: false,
+            primary_packet_size: PacketSize::RegularPacket,
+            secondary_packet_size: None,
             use_extended_packet_size: None,
         }
     }
@@ -639,6 +671,10 @@ pub struct CoverTraffic {
     #[serde(with = "humantime_serde")]
     pub loop_cover_traffic_average_delay: Duration,
 
+    /// Specifies the ratio of `primary_packet_size` to `secondary_packet_size` used in cover traffic.
+    /// Only applicable if `secondary_packet_size` is enabled.
+    pub cover_traffic_primary_size_ratio: f32,
+
     /// Controls whether the dedicated loop cover traffic stream should be enabled.
     /// (and sending packets, on average, every [Self::loop_cover_traffic_average_delay])
     pub disable_loop_cover_traffic_stream: bool,
@@ -648,6 +684,7 @@ impl Default for CoverTraffic {
     fn default() -> Self {
         CoverTraffic {
             loop_cover_traffic_average_delay: DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY,
+            cover_traffic_primary_size_ratio: DEFAULT_COVER_TRAFFIC_PRIMARY_SIZE_RATIO,
             disable_loop_cover_traffic_stream: false,
         }
     }
@@ -805,6 +842,13 @@ pub struct DebugConfig {
     pub reply_surbs: ReplySurbs,
 }
 
+impl DebugConfig {
+    pub fn validate(&self) -> bool {
+        // no other sections have explicit requirements (yet)
+        self.traffic.validate()
+    }
+}
+
 #[derive(Clone, Copy, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
 pub enum ExtendedPacketSize {
diff --git a/common/client-core/src/config/old_config_v1_1_13.rs b/common/client-core/src/config/old_config_v1_1_13.rs
index 85447fc633..f9065cef5d 100644
--- a/common/client-core/src/config/old_config_v1_1_13.rs
+++ b/common/client-core/src/config/old_config_v1_1_13.rs
@@ -105,10 +105,12 @@ impl From<OldDebugConfigV1_1_13> for DebugConfig {
                 disable_main_poisson_packet_distribution: value
                     .disable_main_poisson_packet_distribution,
                 use_extended_packet_size: value.use_extended_packet_size,
+                ..Traffic::default()
             },
             cover_traffic: CoverTraffic {
                 loop_cover_traffic_average_delay: value.loop_cover_traffic_average_delay,
                 disable_loop_cover_traffic_stream: value.disable_loop_cover_traffic_stream,
+                ..CoverTraffic::default()
             },
             gateway_connection: GatewayConnection {
                 gateway_response_timeout: value.gateway_response_timeout,
diff --git a/common/nymsphinx/params/Cargo.toml b/common/nymsphinx/params/Cargo.toml
index 6037bdb333..1ac401e847 100644
--- a/common/nymsphinx/params/Cargo.toml
+++ b/common/nymsphinx/params/Cargo.toml
@@ -9,6 +9,7 @@ repository = { workspace = true }
 
 [dependencies]
 thiserror = "1.0.37"
+serde = { workspace = true }
 
 nym-crypto = { path = "../../crypto", features = ["hashing", "symmetric"] }
 nym-sphinx-types = { path = "../types" }
diff --git a/common/nymsphinx/params/src/packet_sizes.rs b/common/nymsphinx/params/src/packet_sizes.rs
index 3f9501049d..17b1778bcb 100644
--- a/common/nymsphinx/params/src/packet_sizes.rs
+++ b/common/nymsphinx/params/src/packet_sizes.rs
@@ -1,9 +1,10 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::FRAG_ID_LEN;
 use nym_sphinx_types::header::HEADER_SIZE;
 use nym_sphinx_types::PAYLOAD_OVERHEAD_SIZE;
+use serde::{Deserialize, Serialize};
 use std::convert::TryFrom;
 use std::str::FromStr;
 use thiserror::Error;
@@ -34,22 +35,27 @@ pub enum InvalidPacketSize {
 }
 
 #[repr(u8)]
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default, Serialize, Deserialize)]
 pub enum PacketSize {
     // for example instant messaging use case
     #[default]
+    #[serde(rename = "regular")]
     RegularPacket = 1,
 
     // for sending SURB-ACKs
+    #[serde(rename = "ack")]
     AckPacket = 2,
 
     // for example for streaming fast and furious in uncompressed 10bit 4K HDR quality
+    #[serde(rename = "extended32")]
     ExtendedPacket32 = 3,
 
     // for example for streaming fast and furious in heavily compressed lossy RealPlayer quality
+    #[serde(rename = "extended8")]
     ExtendedPacket8 = 4,
 
     // for example for streaming fast and furious in compressed XviD quality
+    #[serde(rename = "extended16")]
     ExtendedPacket16 = 5,
 }
 
diff --git a/common/socks5-client-core/src/config/mod.rs b/common/socks5-client-core/src/config/mod.rs
index a0ebd6f4c7..fbe5f06c8d 100644
--- a/common/socks5-client-core/src/config/mod.rs
+++ b/common/socks5-client-core/src/config/mod.rs
@@ -77,6 +77,11 @@ impl Config {
         }
     }
 
+    pub fn validate(&self) -> bool {
+        // no other sections have explicit requirements (yet)
+        self.base.validate()
+    }
+
     // getters
     pub fn get_base(&self) -> &BaseConfig<Self> {
         &self.base