3 ms·
Would traffic shaping still enable to guess this is a browser usage rather than a typical ssh?
by alex_duf 4y ago
Would traffic shaping still enable to guess this is a browser usage rather than a typical ssh?
- LinuxBender 4y agoI believe you are asking about theoretical machine learning used to identify encrypted traffic patterns. SSH can be used for file transfers via sftp so it is not uncommon to have long transfers of data. In this edge case however one could set up a simple rate limited rsync over ssh and then rate limit ssh slightly higher so that the browsing shares the bandwidth creating a relatively smooth data stream. Data streams are not expected to be perfectly constant across the internet so a little fluctuation would be fine. If Multiplexing is being used via ControlMaster ControlPath in the client then the people browsing will be riding the extra SSH channels without having to re-authenticate after their first authentication. The first SSH channel would be used for the SFTP transfer. rsync -aq --bwlimit=600 /some/dir/big-file ssh-first-hop:/dev/null Then rate limit SSH just above 600KB/s using `tc`. On a modern kernel this is one line. tc qdisc add dev eth0 handle 101: root cake diffserv3 bandwidth 6mbit internet nat egress ack-filter triple-isolate ethernet memlimit 32M One could use HTB bucket rules with tc on older kernels. All of this said, I do not believe this step is required unless a datacenter's SSH traffic patterns were already being traffic profiled and I would theorize that for this to be the case Iran's intelligence agency would have been watching them for other reasons.