Ask Your Question
0

How does wireshark determine the application data protocol when the message is TLS encrypted?

asked 2019-10-21 08:45:29 +0000

R.Feikes gravatar image

I logged some MQTT PINGREQ/PINGRESP messages that are TLS 1.2 encrypted. To my undestanding TLS should encrypt the entire MQTT message (heaeder+payload), or does it not? But in the Transport Layer Security section of the packet descriptions wireshark shows that the application data protocol is MQTT. How can it know that without decrypting the TLS? I did not provide wireshark with the keys etc to perform a decryption. Thanks for any help :)

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-10-21 09:07:15 +0000

R.Feikes gravatar image

Ah well i think i just found the answer. Port 8883 is completely reserved for MQTT over TLS if i understand correctly right? that would explain it, since the destination port is of course visible on the TCP header, can anyone confirm?

edit flag offensive delete link more

Comments

Yes, that's correct. From packet-mqtt.c, you can see the 2 port registrations being done, one for unencrypted MQTT traffic over TCP and the other for encrypted MQTT traffic over TLS:

1698 /*
1699  *  Dissector Handoff
1700  */
1701 void proto_reg_handoff_mqtt(void)
1702 {
1703   dissector_add_uint_with_preference("tcp.port", MQTT_DEFAULT_PORT, mqtt_handle);
1704   ssl_dissector_add(MQTT_SSL_DEFAULT_PORT, mqtt_handle);
1705 }
cmaynard gravatar imagecmaynard ( 2019-10-21 13:19:39 +0000 )edit

Here are the #defines that go with the code snippet above:

:
41 
42 #define MQTT_DEFAULT_PORT     1883 /* IANA registered under service name as mqtt */
43 #define MQTT_SSL_DEFAULT_PORT 8883 /* IANA registered under service name secure-mqtt */
bubbasnmp gravatar imagebubbasnmp ( 2019-10-21 21:55:04 +0000 )edit

Okay cool, thanks for the confirmation :)

R.Feikes gravatar imageR.Feikes ( 2019-10-22 07:20:01 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2019-10-21 08:45:29 +0000

Seen: 67 times

Last updated: Oct 21