Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to know how people test if their network connection is secured. So, if I use ssh, I am told that it is secured. But I want to verify this, so I tried to use tcpdump. Below is the command that I used.

tcpdump port 22 -X

then I get the raw packets which I have no knowledge to interpret. Also, I am not sure if this approach is even correct.

Another exercise of this problem is by using telnet. So, I know it is not secure. But when I try to do the following command:

telnet <IP address> 3306

tcpdump port 3306 -X

The tcpdump output looks cryptic to me as well.

Any suggestions / comments?

share|improve this question
    
I don't think you want to know if the network is secured, you want to know if the network connection is encrypted. You could have an encrypted connection from one host to another but if I had your key it would no longer be secure. –  Clutch Feb 19 '10 at 21:44
    
That is correct. I want to know if the network connection is encrypted. –  bichonfrise74 Feb 20 '10 at 2:43
add comment

5 Answers

up vote 2 down vote accepted

First I don't run as root so I have to use sudo. You can see packets using this on a Mac.

sudo tcpdump -i en0 -X -s 0 src host <server>

If you can't read what you just typed to the server then it is encrypted. I think to actually take the data and decrypted with the key is beyond what you would find here.

share|improve this answer
    
I will try this. –  bichonfrise74 Feb 20 '10 at 2:55
add comment

The best suggestion I can offer is to learn to read the output of the tools you use. Seriously, if you don't know how to interpret the tcpdump why even use it? It's a complex subject but there are many books and articles available to teach you how to read the data.

To make life a lot easier for yourself you should consider using a GUI tool, such as Wireshark, which presents the same information in a format that most people find much easier to read.

share|improve this answer
    
But is it correct to assume that tcpdump can check if a network connection is encrypted? Unfortunately, I'm using a Linux OS so I'm not sure that Wireshark can be used. –  bichonfrise74 Feb 20 '10 at 2:55
    
I don't use tcpdump, so I can't help there. You can install Wireshark on Linux by building it from source. –  John Gardeniers Feb 20 '10 at 8:40
    
Or you can install wireshark from the package provided by the distribution that you are using. –  Justin Feb 21 '10 at 6:27
add comment

SSH is a secure protocol. It your machine is really using SSH, it is secure.

If you are interested in the details, you should check the SSH Protocol definition itself.

http://www.faqs.org/rfcs/rfc4254.html

share|improve this answer
    
While SSH can be secure it doesn't mean that it is secure. SSH1 protocol is not considered as secure as it's vulnerable to certain man-in-the-middle attacks. When most people mention SSH they are really talking about SSH2. Also you can have a SSH connection using the "none" cipher which is not encrypted. –  3dinfluence Feb 19 '10 at 22:50
    
Good point, I didn't think about using the "none" cipher –  Noah Feb 20 '10 at 1:07
add comment

SSH is encrypted and secure, if it thinks anything is wrong (or has changed) it will bleat at you in a very obvious manner. SSHing without an encryption cypher requires an explicit command line switch and it will bleat when you do that to.

tcpdump in and of itself won't tell you if the connection is encrypted or not, you need to analyse the packets yourself. If you don't feel like you can understand the packets directly, then Wireshark can help you there.

share|improve this answer
    
I think I didn't write the question properly, but I know that SSH is encrypted and secure. What I really want is to know how to make sure the connection is encrypted or not. But you did mention to use Wireshark as others have mentioned it too, so I will try this when I get the chance. –  bichonfrise74 Feb 21 '10 at 2:39
    
Let me rephase my answer. The SSH connection is secure by definition. If it isn't secure and encrypted, SSH will tell you. No execptions. –  Haakon Feb 21 '10 at 11:24
add comment

Wireshark is the tool which can help you. Install it on your computer and capture the packets for several minuter, if you can see the content in the packets, then it is decrypted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.