Using Wireshark to verify encryption
Using Wireshark to verify encryption
I am trying to use wireshark to verify that my outgoing rsync is encrypted. I can easily see that the SSH protocol packets are reported as "Encrypted packet." The other packets being exchanged are TCP packets, I am not sure how to actually verify if these are encrypted, and if not, if they contain anything sensitive.
Should TCP be encrypted? Can they leak anything when facilitating the ssh connection? How can I tell?
TCP is on a lower level than SSH, usually SSH uses TCP as its underlying transport layer. TCP as such is not encrypted, but it can of course be used to transport encrypted data.
Are those packages not part of the same SSH connection according to Wireshark?
It looks like everything is in 1 stream, maybe that answers your question? I am capturing traffic only on port 22 briefly while the rsync is running to look at the packets
If the timestamps line up, maybe Wireshark just doesn't manage to understand the entire exchange. What could happen is that Wireshark sees the SSH handshake, and after that it might become just encrypted gibberish due to the encryption. In that case the SSH traffic could just show up as "some kind of TCP".
Do you see an SSH handshake, followed by random crap on the same ports?
(I'm not a Wireshark expert, just an IT guy trying to help!)