3

Consider a proxy that doesn't intercept TLS, but allows CONNECT tunnelling, but only to limited ports (eg: 443 only). If someone runs an ssh server on port 443 and connects to it using CONNECT, would it be possible for the proxy to detect that the protocol inside the tunnel is not HTTP, and block the traffic?

Improve this question

1 Answer 1

Reset to default
6

It is possible to do limited traffic analysis without doing decryption based on timing, size and direction of transferred data. For example HTTP/1 has a request-response pattern where the requests from the client are usually small while the responses from the server are much larger. Additionally the information in the TLS handshake often allow to distinguish normal browsers from other clients based on supported ciphers and their preferences, used TLS extensions etc.

There are actually many articles and publications about this topic which you can find when searching for passive traffic analysis tls.

Improve this answer
1
  • 1
    +1 and contrariwise, if someone is tunnelling (say) SSH over TLS you'll see a very different request/response pattern... multiple tiny round trips eventually followed by a larger server chunk.
    – gowenfawr
    Aug 16, 2019 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .