3

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server IP's and TCP/UDP ports for the telegram service or any other identifier that I can use as a starting point?

I know that the traffic is encrypted. I don't want to look into the content, I just want to register that "this IP used telegram at this time", is that possible? I'm looking for the easiest and the fastest algorithmic way to do this.

2

Looking at http://wiki.squid-cache.org/ConfigExamples/Chat/Telegram It seems like telegram's servers are using two ip blocks :

149.154.164.0/22 149.154.172.0/22

I would assume blocking all traffic to them should suffice.

Edit, did a more thorough check and it seems like there more as's listed on telegram:( searched telegram asn here: https://beta.mxtoolbox.com/supertoolmobile.aspx)

As Number As Name CIDR Range Monitor 59930 Telegram Messenger LLP 91.108.12.0/22 Monitor this 59930 Telegram Messenger LLP 149.154.172.0/22 Monitor this 62014 Telegram Messenger LLP 91.108.16.0/22 Monitor this 62014 Telegram Messenger LLP 91.108.56.0/23 Monitor this 62014 Telegram Messenger LLP 149.154.168.0/22 Monitor this 62041 Telegram Messenger LLP 91.108.4.0/22 Monitor this 62041 Telegram Messenger LLP 91.108.8.0/22 Monitor this 62041 Telegram Messenger LLP 91.108.56.0/22 Monitor this 62041 Telegram Messenger LLP 149.154.160.0/20 Monitor this 62041 Telegram Messenger LLP 149.154.164.0/22 Monitor this

  • as i was reading telegram does something called IP ban evasion technique, so its kinda hard to detect all the range that telegram uses, but your research is more then fine, thank you! – Z. Kiwan Jun 20 '17 at 9:37
  • I don't know of another mechanism, looking at our data the telegram protocol is only being used to these ips. – Jonathan Allon Jun 22 '17 at 9:20
0

I'm not using Telegram myself but what you describe should easily be achievable by simply using a packet sniffer / netcat to figure out which IP is associated with a Telegram server and then simply filter all connections including that IP.

All you need is a bit of scripting or manually process the packet sniffer's logs.

  • Hello AdHominem, telegram uses multiple ip's for comunication, i'm looking for the list of ip's they use like whatsapp for example whatsapp.com/cidr.txt – Z. Kiwan Jan 28 '16 at 12:56
  • Well thats normal, HA server clusters can use multiple IPs. The number is limited, however, so if you run a sniffer again and again from different clients at different times, you will be able to find them all. Another way would be to manually whois the telegram servers. For example 31.13.75.52/32 is the server whatsapp-cdn-shv-01-mrs1.fbcdn.net in the CDN of Whatsapp (which is part of the CDN of FB). So it is possible to make an exhaustive list of all servers which Telegram connects to, scan their name and see if they are affiliated with Telegram. – AdHominem Jan 28 '16 at 14:29
  • don't you think there is a way to do it through packet inspection ? maybe a signature or something ? – Z. Kiwan Jan 28 '16 at 16:14
  • Depends mostly on how much time and effort you want to put in that project ;-) But what you suggest already assumes you know which packets are from Telegram - in order to analyze them by signature. So packet inspection can be a solution to filter Telegram related traffic after you know which packets are relevant. – AdHominem Jan 29 '16 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.