Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a simple way to test a proxy to determine if it is correctly forwarding TCP and UDP traffic? An ideal method would be script-able.

share|improve this question
1  
The first thing you'll need to do is define exactly what you mean by "correct". An HTTP proxy, for instance, can add, remove or modify some HTTP headers and still be considered correct. You'll probably also need to define which of the client, proxy, and server systems you have access to. Is there a security aspect to this question or should it be migrated to SuperUser? –  Ladadadada Feb 25 '13 at 20:09
    
Hi @Jeff, this really isnt a security question. Flag it for a moderator if you want to have it migrated, but you would probably need to flesh it out a bit. –  AviD Feb 26 '13 at 7:17
add comment

closed as off topic by Gilles, Iszi, AviD Feb 26 '13 at 7:16

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

Your question may require more clarification, but it sounds like your concern is that the proxy may be stripping or modifying data. A proxy could combine fragments or something I guess, it would help if we knew the exact components you were working with.

However, in general if you want to test a difference in the packets "naturally" and through some type of proxy, you should capture traffic for the same action "naturally" and then through the proxy and do a comparison. You could capture traffic using Wireshark. Keep in mind you may only want to look at TCP/IP layer 5 data as the TCP specific things like the window and initial values should be different. In wireshark you can usually use one of the filters to compare the TCP stream data, and then you could just diff the natural and proxy captures.

In terms of doing this scriptable. You can using pcap or tcpdump and output it directly to a file. You would then need to write your logic to strip out everything but layer 5 and compare. There may be some scripts out there to just get the layer 5 stuff. Of course, if you are concerned about things at the lower layers as well, filter as needed.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.