1

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got.

Telegram does AES-256 encryption over the users' messages and then send it using normal-Not SSL-transportation protocols (e.g. TCP,HTTP,UDP, etc..)

I tried these capturing scenario:

  • Connecting both mobile phones (sender & receiver) to the same access point that my Laptop-where wireshark is running-connected to.

  • making my laptop as an access point where the two phones are connected to (that's to make sure the packets go through the NIC card in case the router is not allowing packet to be broadcasted coz I'm using my campus's wifi I don't now their configurations )

So in my capture filter I tried many filters I assume the most relevant are :

  • HTTP only: I got many packets, which is useless to check every single one of the 269386 packets captured. that is in the case of scenario one of the capturing trials. So I modified the filter and come up with the second filter.

  • HTTP with my mobile phone IP address (i.e http && ip.addr) but I got no packets at all. though my phone is the sender (in both capturing scenarios). Any ideas what's wrong or what I'm missing here

P.S wireshark is set in promiscuous mode

[UPDATES]

I tested to see if Wireshark does capture any packets going off my phone-even non-telegram ones- but I found that it only captured SSDP, ICMP and some other packets But it captured nothing from my browser, as I logged into my Facebook account,expect one packet it captured of a Youtube page visit??

I tried to use telegram PC version to send msgs but I got SSL (Telegram doesn't use it as they claim, HTTP (unauthorized), ICMP (Pings nothing to do with msgs), UPD (Not sure if these could be the packets, and TCP (Three way handshake packets) [END]

I'm thinking to try wireshark on my friends machine but not sure if that's a solution!!

Improve this question
0

2 Answers 2

Reset to default
2

I'm not really clear about your setup. At one point you seem to say that the laptop is serving as a wireless AP, and in another place it seems like there's a separate AP.

Run Telegram between the PC and the phone and run Wireshark on the PC. In normal use, your wireless AP is not going to repeat traffic destined for other devices to the PC you're using to run Wireshark.

If you must have two phones, you could associate them with two different access points and put a hub (not a switch) in the middle. Then connect the PC to the hub.

Edit: After I've read a little more about Telegram, it seems the clients do not talk to each other, they talk to Telegram's servers. So, you will need something like this:

Diagram showing capture of Telegram packets

If you run Wireshark on the laptop in promiscuous mode, you should be able to see the packets from the phone headed to the Telegram servers.

Note that the connection in the middle must be a hub, not a switch. You should be able to use two or more phones with this setup; I expect you'll see both talking to Telegram's server, and not to each other.

Alternatively, at least with Windows 7, you can turn the laptop itself into an access point. A Google searh will find instructions; one such is here:http://www.firewall.cx/microsoft-knowledgebase/windows-xp-7-8/968-windows-7-access-point.html With the laptop serving as an AP, and connected to the gateway network using a wired connection, is is possible that Wireshark in promiscuous mode might be able to see traffic passing from the wireless radio to the wired Ethernet. If you can put your hands on an Ethernet hub, try the method shown in the diagram. I am sure that'll work.

Improve this answer
4
  • Well, I have two capturing scenarios. but when I use the filter (ip.src==sender phone's IP add.) I got no packets Put I can see packets destined to that phone. I'm using "mypublic wifi" to trun my laptop into AP.and I'm not using Wired connection, it's wifi only here in my block at the campus.
    – user1794499
    Commented Dec 20, 2014 at 17:35
  • If you can see packets going to the phone, you ought to be able to see packets coming from the phone. If I understand correctly, you can see packets with ip.dst == phone, but not with ip.src == phone. Right?
    – Bob Brown
    Commented Dec 20, 2014 at 18:09
  • Yup.That's right
    – user1794499
    Commented Dec 21, 2014 at 8:06
  • Traffics are ecrypted as well, it's not easy to parse them...
    – Yousha Aleayoub
    Commented Mar 27, 2016 at 3:32
1

I have found the way to find the Telegram packets within the captured packets

Since there is a server in between the two parties of the communications; credits go to Bob Brown too.

So after having my friend to help me we found the Telegram server's IP that my laptop communicates with to forward the messages to the other party.And we could filter out all other unrelated packets.

Thanks

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .