CODEWITHSUNDEEP
ctcphttpswiresharklibpcap
elmazzun
elmazzun

Reputation: 1086

How to distinguish between different type of packets in the same HTTPS traffic?

There's something that bothers me: I'd like to distinguish between a packet coming from Youtube and a packet coming from Wikipedia: they both travel on HTTPS and they both come from the port 443.

Since they travel on HTTPS, their payload is not understandable and I can't do a full Deep Packet Inspection: I can only look at Ethernet, IP and TCP struct headers. I may look at the IP address source of both packets and see where they actually come from, but to know if they are from Youtube or Wikipedia I should already know the IP addresses of these two sites.

What I'm trying to figure out is a way to tell from a streaming over HTTP (like Youtube does) and a simple HTML transport (Wikipedia) without investigating the payload.

Edit 1: in a Wireshark session started during a reproducing video I got tons of packets. Maybe I should start looking at the timeout between packets coming from the same address.

Upvotes: 3

Views: 1634

Answers (5)

packetie
packetie

Reputation: 5069

You may consider looking at the server certificate. It will tell you whether it's youtube (google) or facebook. Facebook certificate

That would give you an idea whether SSL connection is to youtube, which one is to facebook.

Upvotes: 1

Peter_V
Peter_V

Reputation: 49

If you are just interested in following the data stream in Wireshark you can use the TCP stream index, filter would be something like tcp.stream == 12

The stream index starts at zero with the first stream that wireshark encounters and increments for each new stream (persistent connection).

So two different streams between the same IPs would have two different numbers. For example a video stream might be 12 and an audio stream, between the same IP addresses, might be 13.

If you started the capture before the stream was initiated you'll be able to see the original traffic setting up the SSL connection (much of this is in clear text)

Upvotes: 1

Luis Colorado
Luis Colorado

Reputation: 12708

Well, you have encountered a dilema. How to get the info users are interchanging with their servers when they have explicitly encrypted the information to get anonymity. The quick response is you can't. But only if you can penetrate on the SSL connection you'll get more information.

Even the SSL certificate interchanged between server and client will be of not help, as it only identifies the server (and not the virtual host you'll try behind this connecton), and more than one SSL server (with the feature known as HTTP virtual host) several servers can be listening for connections on the same port of the same address.

SSL parameters are negotiated just after connection, and virtual server is normally selected with the Host http header field of the request (see RFC-2616) but these ocurr after the SSL negotiation has been finished, so you don't have access to them.

The only thing you can do for sure is to try to identify connections for youtube by the amounts and connection patterns this kind of traffic exhibit.

Upvotes: 0

user3629249
user3629249

Reputation: 16550

this link: Reverse ip, find domain names on ip address

indicates several methods.

Suggest running nslookup on the IP from within a C program.

And remembering that address/ip values can be nested within the data of the packet, it may (probably will) take some investigation of the packet data to get to the originator of the packet

Upvotes: 0

Dmitry Rubanovich
Dmitry Rubanovich

Reputation: 2627

You can try looking at the TCP header options, but generally the traffic is encrypted for a reason... so that it wouldn't be seen by man-in-the-middle. If it were possible, it would be, by definition, a poor encryption standard. Since you have the capture and all the information known to the user agent, you are not "in-the-middle". But you will need to use the user agent info to do the decryption before you can really see inside the stream.

Upvotes: 0

Related Questions