Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -2 down vote favorite

Is there a simple way to test a proxy to determine if it is correctly forwarding TCP and UDP traffic? An ideal method would be script-able.

share|improve this question
1  
The first thing you'll need to do is define exactly what you mean by "correct". An HTTP proxy, for instance, can add, remove or modify some HTTP headers and still be considered correct. You'll probably also need to define which of the client, proxy, and server systems you have access to. Is there a security aspect to this question or should it be migrated to SuperUser? – Ladadadada Feb 25 at 20:09
Hi @Jeff, this really isnt a security question. Flag it for a moderator if you want to have it migrated, but you would probably need to flesh it out a bit. – AviD♦ Feb 26 at 7:17

closed as off topic by Gilles, Iszi, AviD♦ Feb 26 at 7:16

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 1 down vote

Your question may require more clarification, but it sounds like your concern is that the proxy may be stripping or modifying data. A proxy could combine fragments or something I guess, it would help if we knew the exact components you were working with.

However, in general if you want to test a difference in the packets "naturally" and through some type of proxy, you should capture traffic for the same action "naturally" and then through the proxy and do a comparison. You could capture traffic using Wireshark. Keep in mind you may only want to look at TCP/IP layer 5 data as the TCP specific things like the window and initial values should be different. In wireshark you can usually use one of the filters to compare the TCP stream data, and then you could just diff the natural and proxy captures.

In terms of doing this scriptable. You can using pcap or tcpdump and output it directly to a file. You would then need to write your logic to strip out everything but layer 5 and compare. There may be some scripts out there to just get the layer 5 stuff. Of course, if you are concerned about things at the lower layers as well, filter as needed.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.