Re: How do I know my Connection is Encrypted.

Thanks again.

My local ip (behind NAT) is 10.0.1.1 with gateway 10.0.1.100

my ifconfig shows:
eth0 Link encap:Ethernet HWaddr bc:ae:c5:1a:54:78
inet addr:10.0.1.1 Bcast:10.0.1.255 Mask:255.255.255.0
inet6 addr: fe80::beae:c5ff:fe1a:5478/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:19561 errors:0 dropped:0 overruns:0 frame:0
TX packets:17517 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:13994662 (13.9 MB) TX bytes:4627112 (4.6 MB)
Interrupt:41 Base address:0x6000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:655 errors:0 dropped:0 overruns:0 frame:0
TX packets:655 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:52158 (52.1 KB) TX bytes:52158 (52.1 KB)

ppp0 Link encap:Point-to-Point Protocol
inet addr:192.168.1.101 P-t-P:192.168.1.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1
RX packets:911 errors:0 dropped:0 overruns:0 frame:0
TX packets:907 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:244670 (244.6 KB) TX bytes:129423 (129.4 KB)



when I ran

sudo tcpdump -i eth0 -n not proto 47

I saw lots of local network traffic. When I pinged yahoo.com I saw:

23:25:02.571512 IP 10.0.1.1.59535 > 10.0.1.100.53: 19443+ A? yahoo.com. (27)
23:25:02.590849 IP 10.0.1.100.53 > 10.0.1.1.59535: 19443 3/0/0 A 
209.191.122.70, A 72.30.38.140, A 98.139.183.24 (75)

I don't know if this means its working or not.

Based on your analogies I'm beginning to think I need squid at the 
server to achieve encryption back to the client.

Sorry to take so much of your time and thank you for your help.


James Cameron said the following on 04/16/2012 10:12 PM:
> On Mon, Apr 16, 2012 at 09:29:37PM -1000, Mike Gibbons wrote:
>> I hadn't understood that some initial key negotiation was in the
>> clear, so thank you for that explanation. I am using mppe so from your
>> answer I gather that the key exchanges are encrypted.
> Yes, but if I recall correctly it is the same key each side, and this
> simplifies an attack.
>
>> I believe that my client is configured so all eth0 connections passes
>> through ppp0.
> Good.  You can verify this by looking for packets transmitted or
> received by eth0 that are not protocol GRE.
>
> $ sudo tcpdump -i eth0 -n not proto 47
>
> ... and while that command is running, make a connection using some
> client application, like a web browser.
>
> If you see packets displayed, and your connection was successful, then
> you may suspect that the connection was achieved without use of the
> tunnel.
>
> If you see no packets displayed, and there is only the one external
> network interface, then you can be reasonably sure that the packets went
> via the tunnel.
>
>> You say that the blue line from the target to the client does not
>> represent the actual data flow, so does it flow back through the
>> server and if so, is it encrypted between the server and the client?
> I fear I may have not explained properly, again.
>
> Let me explain using a geography example.
>
> Imagine that you live on a farm.  Call that the client.  A nearby town
> is the server.  A city further away is the target.
>
> You are asked to go to the city.  You do it by walking to the town, then
> to the city.
>
> The dark blue line on the diagrams is "farm to city".  It is the
> intention.  The other line on the diagrams are the actual steps taken;
> "farm to town" and "town to city".  These are the implementation.
>
> So with my diagrams, the dark blue line is the intention, or the design,
> of a data flow, and the other lines are how the data flow is actually
> achieved.
>
>> Lastly, how does the client side verify that encryption has been used
>> in the transaction? All the search engine research I have been able to
>> do implies this just has to trusted.
> I agree, there is no way for an application to verify that encryption
> has been used, unless it uses it itself.
>
> An analogy.  You ask your friend to tell another friend a message.  You
> ask your friend to use encryption.  You leave them to it.  How can you
> tell encryption was used?  You can't, unless you observe or receive the
> same message and subject it to analysis.  Even then, the analysis can be
> flawed.  If you don't know the encryption method used by your friend,
> how can you tell that your message was encrypted?  It might appear to be
> noise.
>

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server