Re: How do I know my Connection is Encrypted.

On 17/04/12 8:25 PM, James Cameron wrote:
> On Mon, Apr 16, 2012 at 11:33:42PM -1000, Mike Gibbons wrote:
>    
>> sudo tcpdump -i eth0 -n not proto 47
>>
>> I saw lots of local network traffic. When I pinged yahoo.com I saw:
>>
>> 23:25:02.571512 IP 10.0.1.1.59535>  10.0.1.100.53: 19443+ A? yahoo.com. (27)
>> 23:25:02.590849 IP 10.0.1.100.53>  10.0.1.1.59535: 19443 3/0/0 A
>> 209.191.122.70, A 72.30.38.140, A 98.139.183.24 (75)
>>
>> I don't know if this means its working or not.
>>      
> It means your ping of yahoo.com went direct from the client to the
> target, without going via the server.
>
>    
>> Based on your analogies I'm beginning to think I need squid at the
>> server to achieve encryption back to the client.
>>      
> No, you probably just need to set a default route so that all traffic
> goes via the server.
>
>    
No, this is DNS, his local network (broadcast domain) has a dns server, 
probably his gateway, so his client pc will always prefer that as it's 
directly connected.

The way to fix this is to set your DNS to something not on your local 
network (say, on the pptp server would be a good place) and then pass 
these addresses back via LCP

You can tell it is DNS traffic due to the '.53' attached to the end of 
the IP address.

To see if your traffic is encrypted, the best way would be to do 
something you know will be in plain text (say - type 
http://www.someplace.com into your browser) and then from another 
machine (your gateway) sniff the traffic and see if you can read it. 
Utilities like wireshark would be useful for this, but depending on your 
network setup you might have problems putting something in a position to 
actually sniff the traffic.

As James said though, don't rely on pptp encryption actually being 
useful for stopping anyone that is actually trying to sniff your 
traffic, it will only ever stop the casual attacker, sorta like a really 
bad bike lock will only deter the slacker thieves.

-- 
Steve.

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev