http://qosmos.com/products/protocol-support/ state they are able to identify "Video, URL, date, duration, frame rate, +30 other metadata" for Youtube traffic. Duration, Frame Rate and date seems possible. But how do they identify the URL since it is going to be encrypted?
8
-
this looks like a question for the vendor, and you're assuming that the stream is encrypted– schroeder ♦Commented Jan 25, 2018 at 21:25
-
Are you sure they aren't expecting you to install a local certificate? The characteristics they could simply be fields they extract from the http when the target is youtube..– ÁngelCommented Jan 26, 2018 at 0:14
-
@Ángel Read the URL provided. It mentions that it involves DPI, which does not involve a MITM.– forestCommented Jan 26, 2018 at 4:36
-
@forest but for orgs to perform DPI on data, they require the cert to be installed. The fact the vendor uses the term "DPI" means to me that the stream has to be unencrypted, which means installed certs at some point.– schroeder ♦Commented Jan 26, 2018 at 9:56
-
DPI can also involve things like reading the DNS requests, and IIRC, YouTube has a huge number of subdomains for their CDN. But you're right, DPI for an encrypted connection may require a cert to be installed to avoid browser warnings.– forestCommented Jan 26, 2018 at 14:11
|
Show 3 more comments
1 Answer
In the case of youtube I have doubts that they can decrypt the Quic protocol or even the SSL, I think is what youtube uses right now. The rest of parameters of rate could be deduce a bit, but I think the information that they provide is not updated with reality. In fact you can send them an email of a pcap file with your prefer youtube video and ask them :D
-
This does not answer the question about being able to identify the URL.PLEASE make sure your answers directly answer the question! They do not need to decrypt SSL if they are doing DPI on unencrypted streams as is often the case in corporate environments.– schroeder ♦Commented Jan 26, 2018 at 11:40