Waraxe IT Security Portal

michalkubik · Beginner

Hi, i'm getting desperate

Situation description:
I have 2 computers, they are connected over the switch .

Computer A has:
ip 192.168.0.6 name hostA
there is running SSH server
server part of my TCP/Ip application, listening on port 36000

Computer B has:
ip 192.168.0.14 name hostB
there is running SSH client
client part of my TCP/IP application, sending data on port 36000

I create on host B SSH tunnel with port forwarding by command
ssh -L 34000:hostA:36000 hostB

Afterwards i connect from my client application on ip 127.0.0.1 and port 34000
Until here everything is OK.

Problem description :
I wanted to be sure that my datas are encrypted, so i installed on hostB network monitor, called Ethereal and i can see all my datas, i mean not encrypted as they are going from 192.168.0.14 to 192.168.0.6
Could it be possible that net monitor capture data before the "get into" tunnel and they are encrypted?
Or where else could be the problem?

I also tryed to run net monitor on 3rd computer, but all computers are connected to the switch, so i can not capture communication betwean hostA and host B.

Thanks for help,
Michal

fizzi · Advanced user

Perhaps, i dunno ssh much, your data sent to host B which forwards to host A are not beeing encrypted, which is in fact a design flaw. is the data sending host B to host A encrypted? also it could be possible, that your tcp/ip sniffer is too intelligent, meaning it sniffs your ssl packets and decrypts all the data in time, giving you the nice output you would expect to see.
perhaps you want to try tcpdump. (i guess you are using ethereal)

waraxe · Site admin

All is ok! This is exactly how SSH tunneling works. Because all the data, you are sending FROM client program TO ssh client, is NOT protected by ssh encryption. So your sniffer in HostB actually sees plaintext data before entering SSH tunnel. Now, data between HostAand HostB is encrypted and you can test that by sniffing that traffic. Maybe the switch has special "management port" or you have other possibilities to sniff gobal traffic:

http://www.effetech.com/help/sniffer-faq.htm

You can even try ARP poisoning:

http://www.grc.com/nat/arp.htm

But im sure, that after you have sniffed traffic between HostA and HostB, you will see encryption in place Very Happy

y3dips · Valuable expert