If Bob is using a proxy server and he is communicating with it over TLS. Is it possible for an attacker who is sitting between Bob and the proxy server to determine what type of packet Bob is receiving and requesting to and from the proxy server.

Obviously, attacker can't see the contents of the packets because they are encrypted. But if he wants to know the type of traffic such as ftp, smtp, http, etc. running over TLS will he able to know that?

  • You can look at the traffic in wireshark. You will get to know the port numbers, whether it is a SYN/ACK etc – Limit Nov 10 '16 at 13:51

As @Sjoerd proposed in his answer you can look at the port number. But this does not help if it is not simple a TLS enabled protocol (i.e. smtps instead of smtp, ftps instead of ftp...) but if Bob is using a proxy server or VPN to tunnel the protocol.

In this case one could try to detect the protocol by flow analysis because different protocol have different traffic characteristics regarding which amount of data is sent at which time in which direction. And this behavior is visible from outside the TLS tunnel too.

For example both SMTP and FTP start similar in that the server first sends a short welcome message which is then followed by several small exchanges (i.e. USER, PASS, .. with FTP and EHLO, MAIL FROM, RCPT TO... with SMTP) which are then followed by a larger transfer from client to server with SMTP (i.e. the mail) and most times from server to client with FTP (directory listing). With HTTP instead the clients sends usually a small request (but noticeable larger than the commands within SMTP, FTP) while the server sends a much larger response back.

While it is not possible to be fully sure about the protocol spoken these manual heuristics already provide a way to classify the traffic. Classifying the traffic this way is also relevant outside of TLS because deeper traffic inspection just for classification is often two expensive and slow. If you just search for netflow traffic classification you will find lots of scientific papers and other information for further research.

  • In corporate environment if Bob wants to hide his VPN traffic by routing it over TLS channel. From what you said, I think even VPN over TLS can be detected by flow analysis. – defalt Nov 11 '16 at 4:04

Yes. Your computer connects to a certain port, like 21 for FTP or 80 for HTTP, and only then is the TLS connection set up. An attacker which can listen in on the connection will see which port you connect to, and thus which service you are using.

For more information on what TLS specifically hides there is this video, although it is focused on HTTPS.

  • I'm sure there must be a way to re-direct your every traffic to a specific port number of the proxy server. This is what VPN does. Apart from the port number, is there any other way attacker can come to know? – defalt Nov 10 '16 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.