netstack.fm · March 17 · 16 min

Protocol Shorts: MITM Proxies and Transparent L4 Interception

episode 31 — Protocol Shorts: MITM Proxies and Transparent L4 Interception. In this second "Protocol Shorts" episode, we look at man-in-the-middle proxies from the transport layer up. The episode explains how HTTP proxies, HTTP CONNECT, and SOCKS5 differ, why they all assume a proxy-aware client, and what changes when a transparent layer 4 proxy is inserted by the operating system instead. From there, we dig into protocol detection from the first bytes on the wire and into the BridgeIo abstraction in Rama: a way to relay and inspect stacked handshakes incrementally instead of terminating every protocol upfront. Learn more: https://netstack.fm/#episode-23 — Protocol Shorts: HTTP as an Application Bus https://ramaproxy.org/book/proxies/intro.html — Intro to proxies in the Ramabook https://ramaproxy.org/book/proxies/http.html — HTTP(S) proxies in the Rama boo https://ramaproxy.org/book/proxies/socks5.html — SOCKS5 proxies in the Rama book https://ramaproxy.org/book/proxies/mitm.html — MITM proxies in the Rama book</></li> https://ramaproxy.org/book/proxies/protocol_inspection.html — Protocolinspection in the Rama book https://ramaproxy.org/book/proxies/operate/transparent.html — Operating transparent proxies with Rama https://github.com/plabayo/rama/tree/main/ffi/apple/examples/transparent_proxy — MacOS Transparent Proxy (Rama) example Rama If you like this podcast you might also like our modular network framework in Rust: https://ramaproxy.org Chapters 00:00 Intro 01:00 Understanding Proxies: The Basics 01:18 Diving Deeper into Proxy Types 04:16 Layer 4 Proxies: A New Approach 05:23 Challenges of Transparent Proxies 07:53 Bridging Conversations: A New Insight 09:53 Example: HTTPS request within a SOCKS5 tunnel 13:41 Layer 4 Proxies and Protocol Reconstruction 15:15 Outro Netstack.FM More information: https://netstack.fm/#episode-31 Join our Discord: https://discord.gg/29EetaSYCD Reach out to us: hello@netstack.fm Music for this episode was composed by Dj Mailbox. Listen to his music at https://on.soundcloud.com/4MRyPSNj8FZoVGpytj

0:00-16:13

Play in

Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

episode 31 — Protocol Shorts: MITM Proxies and Transparent L4 Interception.

In this second "Protocol Shorts" episode, we look at man-in-the-middle proxies from the transport layer up. The episode explains how HTTP proxies, HTTP CONNECT, and SOCKS5 differ, why they all assume a proxy-aware client, and what changes when a transparent layer 4 proxy is inserted by the operating system instead.

From there, we dig into protocol detection from the first bytes on the wire and into the BridgeIo abstraction in Rama: a way to relay and inspect stacked handshakes incrementally instead of terminating every protocol upfront.

Learn more: