0

I want to know how people test if their network connection is secured. So, if I use ssh, I am told that it is secured. But I want to verify this, so I tried to use tcpdump. Below is the command that I used.

tcpdump port 22 -X

then I get the raw packets which I have no knowledge to interpret. Also, I am not sure if this approach is even correct.

Another exercise of this problem is by using telnet. So, I know it is not secure. But when I try to do the following command:

telnet <IP address> 3306

tcpdump port 3306 -X

The tcpdump output looks cryptic to me as well.

Any suggestions / comments?

2
  • I don't think you want to know if the network is secured, you want to know if the network connection is encrypted. You could have an encrypted connection from one host to another but if I had your key it would no longer be secure.
    – Clutch
    Feb 19, 2010 at 21:44
  • That is correct. I want to know if the network connection is encrypted. Feb 20, 2010 at 2:43

6 Answers 6

3

First I don't run as root so I have to use sudo. You can see packets using this on a Mac.

sudo tcpdump -i en0 -X -s 0 src host <server>

If you can't read what you just typed to the server then it is encrypted. I think to actually take the data and decrypted with the key is beyond what you would find here.

1
2

The best suggestion I can offer is to learn to read the output of the tools you use. Seriously, if you don't know how to interpret the tcpdump why even use it? It's a complex subject but there are many books and articles available to teach you how to read the data.

To make life a lot easier for yourself you should consider using a GUI tool, such as Wireshark, which presents the same information in a format that most people find much easier to read.

3
  • But is it correct to assume that tcpdump can check if a network connection is encrypted? Unfortunately, I'm using a Linux OS so I'm not sure that Wireshark can be used. Feb 20, 2010 at 2:55
  • I don't use tcpdump, so I can't help there. You can install Wireshark on Linux by building it from source. Feb 20, 2010 at 8:40
  • Or you can install wireshark from the package provided by the distribution that you are using.
    – Justin
    Feb 21, 2010 at 6:27
1

SSH is encrypted and secure, if it thinks anything is wrong (or has changed) it will bleat at you in a very obvious manner. SSHing without an encryption cypher requires an explicit command line switch and it will bleat when you do that to.

tcpdump in and of itself won't tell you if the connection is encrypted or not, you need to analyse the packets yourself. If you don't feel like you can understand the packets directly, then Wireshark can help you there.

2
  • I think I didn't write the question properly, but I know that SSH is encrypted and secure. What I really want is to know how to make sure the connection is encrypted or not. But you did mention to use Wireshark as others have mentioned it too, so I will try this when I get the chance. Feb 21, 2010 at 2:39
  • Let me rephase my answer. The SSH connection is secure by definition. If it isn't secure and encrypted, SSH will tell you. No execptions.
    – Haakon
    Feb 21, 2010 at 11:24
0

SSH is a secure protocol. It your machine is really using SSH, it is secure.

If you are interested in the details, you should check the SSH Protocol definition itself.

http://www.faqs.org/rfcs/rfc4254.html

2
  • While SSH can be secure it doesn't mean that it is secure. SSH1 protocol is not considered as secure as it's vulnerable to certain man-in-the-middle attacks. When most people mention SSH they are really talking about SSH2. Also you can have a SSH connection using the "none" cipher which is not encrypted. Feb 19, 2010 at 22:50
  • Good point, I didn't think about using the "none" cipher
    – Noah
    Feb 20, 2010 at 1:07
0

Wireshark is the tool which can help you. Install it on your computer and capture the packets for several minuter, if you can see the content in the packets, then it is decrypted.

0

When I connect to a host/service and I'm not sure about the security of the connection, I normally run a tcpdump/wireshark to see if the data is sent as cleartext. That's quite helpful with apps/processes/protocols where data MAY or MAY NOT be ciphered (telnet, mysql, ldap, xmpp, smtp, etc). If I have any doubt, I can always search some documentation, how authentication works, which security options are available, and so.

But then again, you must be aware that if you use ssh but your password is "abc123" or reachable from any internet location, it's much more insecure than a telnet with a complex password or with restricted access. Therefore, security must be considered as a whole. It's not only about the protocol/algorithm you use.

And of course, don't pay much credit to those "security experts" saying that "Telnet is insecure". As a curiosity: Telnet+SRP is much more secure and safer than SSH ;)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .