4

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server IP's and TCP/UDP ports for the telegram service or any other identifier that I can use as a starting point?

I know that the traffic is encrypted. I don't want to look into the content, I just want to register that "this IP used telegram at this time", is that possible? I'm looking for the easiest and the fastest algorithmic way to do this.

2 Answers 2

3

Looking at http://wiki.squid-cache.org/ConfigExamples/Chat/Telegram It seems like telegram's servers are using two ip blocks :

149.154.164.0/22 149.154.172.0/22

I would assume blocking all traffic to them should suffice.

Edit, did a more thorough check and it seems like there more as's listed on telegram:( searched telegram asn here: https://beta.mxtoolbox.com/supertoolmobile.aspx)

As Number As Name CIDR Range Monitor 59930 Telegram Messenger LLP 91.108.12.0/22 Monitor this 59930 Telegram Messenger LLP 149.154.172.0/22 Monitor this 62014 Telegram Messenger LLP 91.108.16.0/22 Monitor this 62014 Telegram Messenger LLP 91.108.56.0/23 Monitor this 62014 Telegram Messenger LLP 149.154.168.0/22 Monitor this 62041 Telegram Messenger LLP 91.108.4.0/22 Monitor this 62041 Telegram Messenger LLP 91.108.8.0/22 Monitor this 62041 Telegram Messenger LLP 91.108.56.0/22 Monitor this 62041 Telegram Messenger LLP 149.154.160.0/20 Monitor this 62041 Telegram Messenger LLP 149.154.164.0/22 Monitor this

2
  • as i was reading telegram does something called IP ban evasion technique, so its kinda hard to detect all the range that telegram uses, but your research is more then fine, thank you!
    – Z. Kiwan
    Jun 20, 2017 at 9:37
  • I don't know of another mechanism, looking at our data the telegram protocol is only being used to these ips. Jun 22, 2017 at 9:20
0

I'm not using Telegram myself but what you describe should easily be achievable by simply using a packet sniffer / netcat to figure out which IP is associated with a Telegram server and then simply filter all connections including that IP.

All you need is a bit of scripting or manually process the packet sniffer's logs.

4
  • Hello AdHominem, telegram uses multiple ip's for comunication, i'm looking for the list of ip's they use like whatsapp for example whatsapp.com/cidr.txt
    – Z. Kiwan
    Jan 28, 2016 at 12:56
  • Well thats normal, HA server clusters can use multiple IPs. The number is limited, however, so if you run a sniffer again and again from different clients at different times, you will be able to find them all. Another way would be to manually whois the telegram servers. For example 31.13.75.52/32 is the server whatsapp-cdn-shv-01-mrs1.fbcdn.net in the CDN of Whatsapp (which is part of the CDN of FB). So it is possible to make an exhaustive list of all servers which Telegram connects to, scan their name and see if they are affiliated with Telegram.
    – AdHominem
    Jan 28, 2016 at 14:29
  • don't you think there is a way to do it through packet inspection ? maybe a signature or something ?
    – Z. Kiwan
    Jan 28, 2016 at 16:14
  • Depends mostly on how much time and effort you want to put in that project ;-) But what you suggest already assumes you know which packets are from Telegram - in order to analyze them by signature. So packet inspection can be a solution to filter Telegram related traffic after you know which packets are relevant.
    – AdHominem
    Jan 29, 2016 at 7:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .