I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got.
Telegram does AES-256 encryption over the users' messages and then send it using normal-Not SSL-transportation protocols (e.g. TCP,HTTP,UDP, etc..)
I tried these capturing scenario:
Connecting both mobile phones (sender & receiver) to the same access point that my Laptop-where wireshark is running-connected to.
making my laptop as an access point where the two phones are connected to (that's to make sure the packets go through the NIC card in case the router is not allowing packet to be broadcasted coz I'm using my campus's wifi I don't now their configurations )
So in my capture filter I tried many filters I assume the most relevant are :
HTTP only: I got many packets, which is useless to check every single one of the 269386 packets captured. that is in the case of scenario one of the capturing trials. So I modified the filter and come up with the second filter.
HTTP with my mobile phone IP address (i.e http && ip.addr) but I got no packets at all. though my phone is the sender (in both capturing scenarios). Any ideas what's wrong or what I'm missing here
P.S wireshark is set in promiscuous mode
I tested to see if Wireshark does capture any packets going off my phone-even non-telegram ones- but I found that it only captured SSDP, ICMP and some other packets But it captured nothing from my browser, as I logged into my Facebook account,expect one packet it captured of a Youtube page visit??
I tried to use telegram PC version to send msgs but I got SSL (Telegram doesn't use it as they claim, HTTP (unauthorized), ICMP (Pings nothing to do with msgs), UPD (Not sure if these could be the packets, and TCP (Three way handshake packets) [END]
I'm thinking to try wireshark on my friends machine but not sure if that's a solution!!