Have you ever wondered what any specific application was sending over your network? If you want to know that, or even want to find out how a proprietary protocol works, you should give Wireshark (www.wireshark.org) a try! Today i’m going to peek into the network traffic of my email client. First I have to check the ip of the mailserver i’m using. I am going to use the ip to filter out network traffic which is send to or received from that specific server.
As we can clearly see by using ping, the ip is 212.227.17.185, so lets fire up Wireshark. Lucky for us that Wireshark brings some very mighty, built in protocol parsing features. Lets just select the pop-protocol, which is used to transfer the emails from the server to my client.
Additionally we want to fitler by the servers ip, which is possible by further specifying the filter expression.
Now lets select the network interface of my wlan stick, which is the second one. If you can’t tell the interfaces apart just click on “details” to get some hints. Click start to start the capturing of packets.
After you started capturing packets you should, of course, generate some traffic to be captured by triggering a network event. I let Thunderbird check if I received a new email and expectet to see some packets flowing back. But what happend is: Nothing! The packet list stays empty. Maybe the ip was wrong? Let’s send another ping.
Well thats interesting! I get different ip’s for the same hostname. Looks like the mail hoster is distributing the clients over different servers by just returning different ip’s. Lets just filter all traffic coming from any ip in that range by changing the filter to be “pop and ip.src==212.227.17.0/8”. Apply the changes an suddenly I can see all the packets which were received from the sever. To see the packets send from my client to the server just change “ip.src” to be “ip.dst”.
The second request send to the server is “STLS”, which asks the server to start an encrypted TLS or SSL connection. And it looks like the request was succesfull since the following packets are encrypted. If that wouldn’t be the case I could see my email account and password being send to the server. Since I’m using a wlan to transmit my network traffic everybody else using the network can see the exact same packts i’m seeing now. Good to know the encrpytion of my email client works as expected. But what about usernames and passwords I enter on websites? As you can guess by now, they are send in clear text if i’m not using https, which is the encrypted equivilant of http protocol.
Filed under: Network
Word Gems 