Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm sniffing a connection that uses ICEP (ZeroC ICE Protocol), and its packet bodies compressed using BZ2 (GNU BZip 2) algorithm.

I want to find out whether packets encrypted, or not. ICEP can use OpenSSL to encrypt the traffic.

Additional Info

It's a local network, and I use WireShark to analyze the traffic. The client is a .Net application on windows, and Server is a Python application on a Gnu/Linux machine. If they use any encryption, it is possibly the ADH (Anonymous Diffie-Hellman cipher) cipher.

I also tried to use the command # openssl s_client, but it says:

CONNECTED(00000003) 3894:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:583:

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Watch the stream and look for negotiation using defined encryption protocols. If you know the data is compressed with bzip2, look for the strings 0x314159265359 and 0x177245385090. Unless headers are totally stripped out, they'll appear once for every block. You can take a guess at whether data is encrypted by following the stream and checking for entropy. The more entropy per bit, the more likely you're seeing encryption. This unfortunately applies to compression as well.

I would say that you can discern known encrypted, or known unencrypted. Differentiating encryption or compression would take a while and involve more complex code without header information for magic strings (like above) to give it away.

share|improve this answer
1  
I never realised bzip2 used those particular numbers. That's made my day:-) (yeah, I'm a maths geek) –  Rory Alsop Mar 19 '11 at 18:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.