0

I am writing a program which can detects protocols used in network packets. For every packet receives it will try to detect protocols in layers such network and transport. Detecting protocols in these two layer was very easy because somewhere in the packet we have some bytes which tell us about protocols. But for application layers, it's much harder as I know. No where in a HTTP packet is not mentioned the protocol (as far as I know). And another difficulty during detecting application layer protocols is that it is possible that a whole HTTP request or response takes more than one packet, and it's lot harder to concatenate multiple packets.

I want to know theoretically how can I detect these protocols.

user207421
  • 305,947
  • 44
  • 307
  • 483
Amir reza Riahi
  • 1,540
  • 2
  • 8
  • 34
  • Many applications even have proprietary application-layer protocols. For example, Skype used to have that before Microsoft bought it and changed everything. Many people asked about how to decode that, but it was always kept secret. – Ron Maupin Nov 21 '20 at 14:58

1 Answers1

2

Unfortunately there's no simple answer. While there aren't that many network and transport layer protocols and the ones that exist are well standardized, the application layer is a lot messier.

One way to guess the application protocol is to look at various "hints" like port number, the presence of certain strings in specific locations (e.g. "HTTP"), packet lengths etc. But it's not bulletproof. I can easily run some custom protocol on port 80 which happens to contain "HTTP" in the payload but isn't HTTP. This is why even dedicated tools like wireshark sometimes fail to detect the correct protocol. By the way, you could use wireshark's source code for the specifics on how it dissects different protocols.

Regarding protocols being sent in more than one packet - that's easier. Your parser has to treat TCP as the stream protocol it is. Individual packets are meaningless in TCP and your parser has to track the stream across multiple packets.

Malt
  • 28,965
  • 9
  • 65
  • 105
  • "_While there aren't that many network and transport layer protocols and the ones that exist are well standardized_" There are dozens of transport-layer protocols. See the IANA maintained _[Assigned Internet Protocol Numbers](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)_ page. It is easy to simply translate the protocol number in the IPv4 header, or the Next Header value in the IPv6 header, to a table from the IANA page. – Ron Maupin Nov 21 '20 at 14:57