Telling encrypted (TLS) and unencrypted traffic apart with Wireshark
In one capture you compare how unencrypted protocols (HTTP, FTP) expose everything and what TLS hides and still shows: the protocol hierarchy, the Client Hello and SNI, the TLS version, adding the server name as a column, application data; you capture a live HTTP Basic logon, see that encoding isn’t encryption and report your findings.
Level 101 · 50 min
Management asks: "How much of the company’s traffic is encrypted? What can be seen even in encrypted traffic?" Daniel wants you to answer that. The capture: ~/ws/sifreli.pcapng.
TLS (Transport Layer Security) is the "S" in HTTPS: it encrypts data and verifies the server’s identity. But it doesn’t hide everything: IP addresses, ports, timing, sizes and the SNI (Server Name Indication, the name of the server being visited) inside the Client Hello sent at the start of the connection stay visible. Analogy: a sealed envelope. You can’t read the letter inside, but everyone sees the address on the envelope.
Close any Wireshark windows left open from earlier lessons: the desktop runs with 2 GB of memory.
What you will do in this lesson
- The protocol hierarchy
- In cleartext everything is open
- What does TLS show?
- The address on the envelope: SNI
- Make SNI a column
- The TLS version and the fingerprint idea
- A live test: HTTP Basic
- Encoding is not encryption
- The answer to management
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Summarising traffic with the protocol hierarchy
- Finding and reporting credentials sent unencrypted
- Reading FTP control and data connections
- Telling what TLS hides from what it shows
- Reading the SNI from a Client Hello
- Adding a field as a column
- Showing that HTTP Basic authentication is just base64
- Reporting traffic findings
← Following a TCP stream in Wireshark · Wireshark fundamentals · Filtering and watching DNS traffic with Wireshark →
Start for free