Skype: remove old detection logic #1954
Conversation
|
Kudos, SonarCloud Quality Gate passed!
|
Is there any information available that supports your thesis? I am not familiar with Skype/Teams, but I am using those on a daily base and would be very sad if |
| @@ -43,7 +43,7 @@ JA3 Host Stats: | |||
| 1 192.168.1.117 4 | |||
|
|
|||
|
|
|||
| 1 UDP 192.168.1.117:58327 <-> 109.94.160.99:8801 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: Video/26][10 pkts/7806 bytes <-> 175 pkts/184434 bytes][Goodput ratio: 95/96][1.44 sec][bytes ratio: -0.919 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 14/8 32/35 11/5][Pkt Len c2s/s2c min/avg/max/stddev: 55/60 781/1054 1071/1071 444/129][PLAIN TEXT (replace)][Plen Bins: 1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,97,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] | |||
There was a problem hiding this comment.
I don't think Zoom is cleartext
There was a problem hiding this comment.
It is not. Somehow while "Zoom" is correctly associated to "Encrypted", "RTP.Zoom" is associated to "ClearText", which seems wrong to me. Probably an unrelated bug; I'll try to fix it in a new version of this PR
src/lib/protocols/skype.c
Outdated
| u_int16_t sport = ntohs(packet->udp->source); | ||
| u_int16_t dport = ntohs(packet->udp->dest); | ||
|
|
||
| /* skype-to-skype */ |
There was a problem hiding this comment.
is skype-to-skype protocol still recognized without this code? Did you check that?
There was a problem hiding this comment.
If with "skype-to-skype" you mean an interaction between "Skype-app" or "Skype-from-a-broswer" to/from "Skype-app" or "Skype-from-a-broswer", yes, I checked that. Always standard STUN or TLS stuff
I check Skype traffic regularly on some common environments (win/android/linux with app or via browser) and I have seen only STUN/TLS for a few years. Anyway, we can keep this code around a little more; no specific harm in that |
IvanNardi
force-pushed
the
skype-old
branch
2 times, most recently
from
2815553
to
c599d2c
Compare
|
Will there be any updates on this PR? If you need more pcap samples to confirm that Skype is only using TLS and STUN these days, I can capture some. |
|
Is the old detection logic not used anymore (for sure)? |
Yeah, here's Skype for Android traffic (login and test call). |
I'd also capture Skype for iOS traffic as well, but I dunno how to do it. |
|
What about skype for desktops? |
|
I tested win11 (both via browser and via app) and ubuntu (browser) to from android/landline: standard STUN stuff. |
Here's a skype for linux pcap sample |
Skype has been using standard protocols (STUN/ICE or TLS) for a long, long time, now. Long gone are the days of Skype as a distribuited protocol. See: ntop#2166
|
|
Thanks everyone! |
Skype has been using standard protocols (STUN/ICE or TLS) for a long, long time, now. Long gone are the days of Skype as a distribuited protocol.
See: #2166