0

The link talks about TCP over TCP when http is used over SOCKS via SSH.

I am trying to browse from Firefox (on Ubuntu 14.04) after setting up the SOCKS5 proxy option via localhost. I created a SOCKS5 connection using SSH (created using SSH -D) to another host (which then takes the packets and routes them out).

The link says that SSH can be made to work in a none encryption mode, but after applying the small patch suggested there to OpenSSH's cipher.c, I see encrypted packets in wireshark even though it says (encryption:none mac:umac-64@openssh.com compression:none)

SSH Protocol
    SSH Version 2 (encryption:none mac:umac-64-etm@openssh.com compression:none)
    Packet Length: 48
    Encrypted Packet: 0932000000076d696e696e65740000000e7373682d636f6e...
    MAC: 1a7bf2cfa15def0f

I would like to verify if this is actually a TCP over TCP connection.

Edit: does it matter that I get prompted for a password when I start the SSH -D (ssh user@host2 -D 8080). Somehow, I am unable to get host2 to not prompt me for a password (even though I added host1's key into host2).

  • If it has different public ip: checkip.amazonaws.com – Ipor Sircer Sep 21 '16 at 8:38
  • Have you applied the patch to the server too and /etc/ssh/sshd_config? Check the output of the client ssh -vvv -D ... – rudimeier Sep 21 '16 at 8:54
  • @Ipor Sircer, not sure if I understand what you meant. – nnovoice Sep 23 '16 at 7:58
  • @rudimeier, yes I did. The change to cipher.c is a common to both client and server. I will post the output of ssh -vvv -D. Thank you. – nnovoice Sep 23 '16 at 7:59
0

I'm not sure what's the problem with that ssh patch. But why are you watching the traffic of the ssh connection? You could sniff the traffic between your web browser and the forwarding socket on lo device instead:

tcpdump -i lo port 10080

Or similar in wireshark.

  • the question I wish to pursue is whether the traffic inside the tunnel is TCP-over-TCP. Will it help to capture the traffic before it gets into the tunnel? But, I did try this: tcpdump -i lo port 8080 -w file.pcap. The capture had nothing related to what I wanted to see. I can share the capture if you would like me to. Thank you. – nnovoice Sep 23 '16 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.