2 ms·
I am intrigued: do you know of any good writeups on how to discern the SSL-VPN traffic of Cisco AnyConnect from SSL-HTTP traffic of a browser?
by chx 8y ago
I am intrigued: do you know of any good writeups on how to discern the SSL-VPN traffic of Cisco AnyConnect from SSL-HTTP traffic of a browser?
- erikb 8y agoI have no details but wouldn't be surprised if especially Cisco announces as metadata something like "this package is encrypted by Cisco AnyConnect version 1.2.3 https://cisco.com/" https://cisco.com/".
- AmericanChopper 8y agoStudying TLS encapsulated traffic has been around for a long time. I remember one thing that was really obvious to detect was a TCP handshake occurring inside a TLS session. That's how China is able to block TLS VPNs. Although the practice is a bit of a continuous arms race between obfuscation and detection.