if I:
ssh -fND localhost:6000 somebody at 192.168.56.5 -p PORTNUMBER
from computer "A" to computer "B" [B = 192.168.56.5] then I
can set the
SOCKS proxy for e.g.: Firefox to use "localhost:6000" on computer
"A".
Ok. I can surf the web through "B".
But:
- Can anyone sniff the traffic of "A"? [e.g.: computers on same subnet
as "A"] Like DNS requests? - I think no, but I'm not sure :O
- Can anyone sniff the traffic of computer "B"? e.g.: B computer is at
a server farm [others in the farm can see the traffic?] - I think yes,
but I'm not sure :O
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.centos.org/pipermail/centos/attachments/20091204/04e2feeb/attachment-0001.html>
>if I: > >ssh -fND localhost:6000 somebody at 192.168.56.5 -p PORTNUMBER > >from computer "A" to computer "B" [B = 192.168.56.5] then I can set the SOCKS proxy for e.g.: Firefox to use "localhost:6000" on computer "A". Ok. I can surf the web through "B". > >But: >- Can anyone sniff the traffic of "A"? [e.g.: computers on same subnet as "A"] Like DNS requests? - I think no, but I'm not sure :OSure, that possible if your name resolution traverses a network path interceptable by the guy sniffing.>- Can anyone sniff the traffic of computer "B"? e.g.: B computer is at a server farm [others in the farm can see the traffic?] - I think yes, but I'm not sure :OSame thing, if the outbound web traffic leaves that host via a route another op has access to, like a switch with a mirror port, he can easily see what's moving back and forth.
Tudod Ki wrote:> if I: > > ssh -fND localhost:6000 somebody at 192.168.56.5 -p PORTNUMBER > > from computer "A" to computer "B" [B = 192.168.56.5] then I can set the > SOCKS proxy for e.g.: Firefox to use "localhost:6000" on computer "A". > Ok. I can surf the web through "B". > > But: > - Can anyone sniff the traffic of "A"? [e.g.: computers on same subnet > as "A"] Like DNS requests? - I think no, but I'm not sure :OThe packets between A and B will be be visible only as encrypted ssh packets. DNS lookups will depend on the client socks protocol. Socks4 did the lookups on the client and was extended as socks4a to do dns on the server. Socks5 lets the server handle dns.> - Can anyone sniff the traffic of computer "B"? e.g.: B computer is at a > server farm [others in the farm can see the traffic?] - I think yes, but > I'm not sure :OThe A-B connection will appear here as well, as encrypted ssh packets. The proxied outbound connections will be unencrypted but will appear to originate from B. If you are the only one connected it wouldn't be too hard to deduce what is going on - and the packets will mostly correspond one for one timing wise. So, the connection wouldn't be obvious, but I wouldn't count on not getting caught if you are doing something illegal. -- Les Mikesell lesmikesell at gmail.com