Unit 6: HTTP and TLS on the wire · Lesson 4 of 5 · 20 min
AI traffic on the wire
Find which AI services the office talks to, compare them with the approved list and measure what was sent.
mission
- You are
- The analyst enforcing the AI use policy.
- Situation
- corp.example allows one AI assistant, run in a company tenant. Data protection suspects staff paste documents into other chatbots and AI APIs.
- Goal
- From egress.pcap, list every AI service in use, check each against
~/inventory/approved-ai.txtand measure the uploads. - Hand in
- The unapproved service, the laptop using it and how much it sent.
AI traffic leaving the office
Read the policy
Start from what is allowed. Everything else is a question.
cat inventory/approved-ai.txt
Approved AI services, reviewed 2026-09-15
chat.ai-assistant.example company tenant, SSO, prompts not used for training
cat- Prints the contents of one or more files. Built into Linux and macOS.
Find AI services by name
SNI filters accept contains. Search for the words AI services tend to use in their names, then read the list by eye.
tshark -r egress.pcap -Y 'tls.handshake.extensions_server_name contains "ai-" || tls.handshake.extensions_server_name contains "llm"' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c
3 10.10.0.23 chat.ai-assistant.example
1 10.10.0.31 api.llm-vendor.example
you should see One approved service, one that is not on the list.
defender tip Keyword searches miss services with plain names. In real work, compare every SNI against a maintained list of AI domains, which secure web gateways and DNS filters already ship.
tshark- The command-line version of Wireshark. Reads captures and filters packets by protocol fields. Install with sudo apt install tshark, or brew install wireshark on a Mac.
sort- Sorts lines of text. Built into Linux and macOS.
uniq- Collapses repeated neighbouring lines. With -c it counts them. Built into Linux and macOS.
Measure the upload
A chat prompt is a few kilobytes. A document upload is hundreds.
tshark -r egress.pcap -q -z conv,ip,ip.addr==198.51.100.140 | sed -n '6p' 10.10.0.31 <-> 198.51.100.140 15 12 kB 212 293 kB 227 306 kB 95.000000000 0.0718 tshark -r egress.pcap -q -z conv,ip,ip.addr==198.51.100.141 | sed -n '6p' 10.10.0.23 <-> 198.51.100.141 39 28 kB 36 14 kB 75 43 kB 20.000000000 110.0274
you should see laptop-akim sent 293 kB to the unapproved API in under a tenth of a second. The approved assistant received 14 kB of prompts.
sed- Edits text as it streams past, for example to replace or delete lines. Built into Linux and macOS.
Two kinds of AI use
10.10.0.31 -> api.llm-vendor.example 293 kB out in one session no tenant, no SSO, unknown retention
A document left the company. Find out which one and talk to the user.
10.10.0.23 -> chat.ai-assistant.example 14 kB out over 3 sessions company tenant, SSO, logged
Normal use of the sanctioned tool.
Count AI sessions per laptop
Group the AI sessions by client to see who to talk to.
tshark -r egress.pcap -Y 'tls.handshake.extensions_server_name contains "ai-" || tls.handshake.extensions_server_name contains "llm"' -T fields -e ip.src | sort | uniq -c
3 10.10.0.23
1 10.10.0.31
you should see Two laptops use AI services: 10.10.0.23 with three sessions and 10.10.0.31 with one.
What a defender takes away
- 1SNI and byte counts are enough to enforce an AI policy without breaking encryption.
- 2Upload size separates chatting from pasting whole documents.
- 3The best control is a good approved tool. Blocking alone pushes people to phones and home laptops.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.