Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are categorizing the network traffic , like determining if it is facebook,yahoo etc... Now I have been asked also seperate mobile devices(like ipad, nexus, iphone). It is easy to that in HTTP with user agent information.

But I also need to consider HTTPS protocol , is there any way I get any information about user device in "client hello" or "certificate" messages?

share|improve this question
add comment

2 Answers

Provided they're not using something like VPN or a Proxy you should be able to check a few things with an app like WireShark:

  1. DNS requests for different websites (before the TLS or HTTPS devices will typically look-up the server). Eg. Facebook is using Akamai so if you can capture a DNS packet bound for fb.*\.akamai\.net that will give you both IPs (and the client MAC address). Then you can track the traffic from that IP through the session.
  2. IP Reverse Look-up (You can check an outside service's IP registrant at a directory like ARIN) - whois -h whois.arin.net 8.8.8.8
  3. You can look-up the device manufacturer via MAC Address
  4. Like Manishearth was saying, you can try to catch a user agent from web browsing on the same IP during that same session, then marry the user_agent to the MAC Address.
share|improve this answer
add comment

Not directly. The Certificate message is sent by the server. The ClientHello may help categorizing things, as different browsers/devices support different algorithms.

Instead, it may help to use the HTTP user agent to associate a device to an IP address and then use that tag for HTTPS connections.

share|improve this answer
    
I expect most browsers to have different ClientHellos. At least Opera, Firefox and Internet Explorer are totally different. –  CodesInChaos Jun 14 '13 at 8:12
    
@CodesInChaos: Hmm, you're right. Edited out. –  Manishearth Jun 14 '13 at 8:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.