Application control detects encrypted traffic

Forum|Forum|8 years ago
February 15, 2018
6 replies
11995 views

Hi experts,

How can Application Control detect applications over encrypted traffic? I am using Application Control and works fine, I can block youtube videos, facebook and so on, over HTTPS, so the traffic is encrypted. But I am not enabling deep inspection and it can detects applications anyway. How can Application Control do this without enabling deep inspection?

Regards,

Julián

Best answer by jacob_shaw

Additionally, Application Control probably looks at the Server Name Indication (SNI) header at the start of the TLS handshake process and tags that TLS stream accordingly. The SNI (usually the domain name of the server. eg. "www.google.com") is normally passed unencrypted during the initial handshake process. You can see this in Wireshark. Look under "Extension: server_name" in a Client Hello packet.

fjulianomAuthor

Explorer II

Hi guys,

Any idea? The question is short, how can FortiGate recognise application patterns within the traffic when this is encrypted? Deep inspection is not being used.

Regards,

Julián

dieter

New Member

URL's and ip-ranges already reveal a lot, I guess.

Maybe packet headers also contain very specific things.

fjulianomAuthor

Explorer II

Hi dieter,

It could be, but Application control doesn't work with URL's as Web filtering does. According to NSE4, it matches patterns in the entire byte stream of the packet, and then looks for patterns, and not only works with the packet headers.

Regards,

Julián

Sign up

Login with SSO

Login to the community

Login with SSO