In theory it is impossible to know the content of such a message but there is still metadata. For example, you can see that the connection to port 443 has lots of uplink traffic compared to downloads. From this perspective it is the job of a proxy or the IPS to drop the connection. Please note that this is very likely prone to errors.
So if I were to filter every user on this network through a 20kbps pipe, theoretically the network would only allow messages since other transfers usually cancel themselves within the app.
Since the most Apps or Websites are SSL crypted you need to change the certificate on the Sense and play man-in-the-middle. Some apps doesn´t care about it - others does.
Sophos UTM or XG have such an "Application Control" feature. You have to pay for.
This is wrong - the certificate does not need to be touched nor the TLS connection by itself. The only thing is that the connection can be dropped (TCP RST) after more traffic tries to cross the transparent proxy (for example more that 2 Mbit per second).
That information of probably off-topic.
Are you sure ? How do you know which Applications is current active inside a SSL Stream ?
Most Apps use a https connection. As long as you can´t see the data inside the stream you will be unable to know what happen. I can send images and audio files with WhatsApp or Threema with the speed of an "Edge" Mobile Network without any problems. That is not faster 2 Mbit and works.
Most TLS implementations include SNI which will include the hostname. When this is extracted, you can guess the application.
The data sent over the encrypted stream will increase if an image is sent instead of a plain text message.
Quote from: fabian on March 14, 2018, 07:48:49 pmIn theory it is impossible to know the content of such a message but there is still metadata. For example, you can see that the connection to port 443 has lots of uplink traffic compared to downloads. From this perspective it is the job of a proxy or the IPS to drop the connection. Please note that this is very likely prone to errors.So if I were to filter every user on this network through a 20kbps pipe, theoretically the network would only allow messages since other transfers usually cancel themselves within the app. But is there a way to link specific ports to types of data transfer or should I stick to data throttling? I've found very little information about the way these apps work over a network, though I've mostly looked into WhatsApp since its my priority.
