I have successfully performed a MITM attack and have managed to view the HTTP/HTTPS packets of the victim passing through the nat table of the PREROUTING chain of my iptables.(using -j LOG) However, why am I not able to see Skype traffic from the victim in the nat table of the PREROUTING chain as well? The Skype traffic appears normally in the raw and mangle table but somehow 'disappears' from the nat table. I have already enabled ip forwarding. Any possibilities for this weird behavior? The Skype traffic is simply just TCP encrypted with TLS.

  • Does skype still connect through TCP+TLS when you use interception? I'd expect a TLS handshake failure when the TLS connection gets attacked like that (which might induce skype to switch to a different transport, like UDP). May 5, 2017 at 17:52
  • Yup wireshark still sees the traffic as TCP+TLS even when MITM is in place May 5, 2017 at 18:08


You must log in to answer this question.

Browse other questions tagged .