Unit 6: HTTP and TLS on the wire · Lesson 3 of 5 · 16 min
What TLS still reveals
Measure what an observer learns from encrypted traffic: who, which service, how much and when.
mission
- You are
- The analyst answering a privacy question.
- Situation
- Legal asks whether the security team can see what staff do on HTTPS sites. The honest answer is: less than they fear, more than they think.
- Goal
- List what tls.pcap reveals without any keys, and what it hides.
- Hand in
- Which server sent the most data and what you could not see.
What an encrypted session still shows
Try to read HTTP
Inside TLS there is no HTTP for tshark to decode.
tshark -r tls.pcap -Y http | wc -l
0
you should see Nothing. Paths, headers and cookies are sealed.
Measure who sent what
Conversation statistics still work: addresses, frames and bytes in each direction, plus start time and duration.
tshark -r tls.pcap -q -z conv,ip
================================================================================
IPv4 Conversations
Filter:<No Filter>
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
10.10.0.23 <-> 198.51.100.20 17 18 kB 8 1033 bytes 25 19 kB 5.100000000 0.0234
10.10.0.23 <-> 10.20.0.40 10 8195 bytes 8 949 bytes 18 9144 bytes 0.000000000 0.0220
10.10.0.31 <-> 10.20.0.70 9 5433 bytes 8 903 bytes 17 6336 bytes 2.500000000 0.0218
================================================================================
you should see The <- columns are data flowing to the address on the left. www.example.com sent the most: 18 kB.
Name the services
With the SNI from each Client Hello, those addresses become services.
tshark -r tls.pcap -Y 'tls.handshake.type==1' -T fields -e ip.dst -e tls.handshake.extensions_server_name
10.20.0.40 intranet.corp.example
10.20.0.70 hr.corp.example
198.51.100.20 www.example.com
you should see Who, which site, how much, when: all visible. What page and what content: not.
defender tip Encrypted Client Hello (ECH) hides the SNI too. As it spreads, defenders lean more on DNS logs and the company's own proxy.
Visible and hidden in a TLS session
| Command | What it does |
|---|---|
Visible | IP addresses, ports, server name (SNI), TLS version, byte counts, timing |
Hidden | URL path, query string, headers, cookies, form fields, page content |
Hidden with ECH | Also the real server name |
Read the negotiated versions
TLS 1.3 servers still write 0x0303 in the old version field and put 0x0304 in an extension. A server with no extension is speaking an older version.
tshark -r tls.pcap -Y 'tls.handshake.type==2' -T fields -e ip.src -e tls.handshake.version -e tls.handshake.extensions.supported_version
10.20.0.40 0x0303 0x0304
10.20.0.70 0x0301
198.51.100.20 0x0303 0x0304
you should see Two servers negotiate TLS 1.3. hr.corp.example answers with 0x0301, which is TLS 1.0.
What a defender takes away
- 1TLS hides content, not the fact of the conversation.
- 2SNI plus byte counts is enough for most policy questions.
- 3Write down what you can and cannot see before you promise legal anything.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.