If I send a HTTPS request to a IP address directly will anybody spying on my network be able to see that IP address? For example if someone captures my HTTPS packets will they be able to identify which server I am connecting to?


Yes, they will. It doesn't make any difference which application layer (L7) protocol you are using for the communication, as IP addresses and routing is happening on lower network layer (L3). See e.g. List of network protocols (OSI model).

Anyone being able to capture your HTTPS traffic knows the site you are visiting:

  • The IP headers (L3) reveals both source and destination IP addresses.

  • From the destination port 443 in the TCP headers (L4) you can guess it's probably HTTPS, and it's easy to test whether there's a web server listening or not.

  • The HTTPS – or the TLS handshake providing the encrypted channel for HTTP – reveals even more. Among many things, the ClientHello has Server Name Indication (SNI) extension. This means that anyone capturing the beginning of the HTTPS session also has the hostname in plain text.

    SNI for security.stackexchange.com

  • 2
    That's why TLS only protects the content of the transmission, not the metadata. And often enough, that metadata may reveal more than enough. – MechMK1 Oct 30 '19 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.