8

If I set up an SSH tunnel to a remote server, can a man in the middle see the IP address of that server?

If we step it up a notch, if the FBI is tracking you (AFAIK I'm not being tracked), can they see where your traffic is being tunneled to if they're monitoring you at the ISP level?

I'm asking because if the FBI did track me, it'd be useful to know if an SSH tunnel would be sufficient. If they could find the server, they could easily just monitor that server's unencrypted traffic to the internet.

Thanks.

Improve this question

3 Answers 3

Reset to default
10

It depends on how the SSH tunnel is setup, but, generally speaking, there are ways to track things. Let's talk about the high-level scenario.

When I make an SSH connection to a server, the contents of my SSH conversation with that server are secure -- they're encrypted, so you have to break SSH to know what we're saying. However, the IP packets carrying that conversation cannot be encrypted, so if you were to look at one IP packet in that conversation, you'd know where I am (IP source address) and where the SSH server is (IP destination address).

In an SSH tunnel, the conversation I'm having with the server is another TCP/IP conversation to some other remote destination. So inside the tunnel, that second network connection is encrypted, but once it gets to the other end of the tunnel, it's unencrypted internet traffic.

Now. If you were to find that second conversation in the clear, all you'd see is the final destination of the conversation (IP destination address) and the SSH server (IP source address). There's not much in those packets (considering TCP/IP headers only) to differentiate it from some other internet traffic that was created on the SSH server machine; I don't believe there's anything specific in the packets that indicates SSH had anything to do with it.

That doesn't mean it can't be connected back to me -- just that you couldn't do that just by examining TCP/IP headers. For example, deep packet inspection (looking at the data payload in addition to packet headers) could certainly identify me if I'm using the tunnel to login to my Gmail account without SSL. As another example, someone who can root the SSH server hosting my tunnel can figure out what port the tunnel is operating on, and then they can track me by TCP/IP headers.

So no, SSH tunnelling by itself will not be sufficient to hide your e-footprints from a determined tracker.

Improve this answer
1
  • does this mean, however, if you SSH to your home computer from, say, work that nobody @ work could tell what you were doing, other then connecting to that home computer? (ie. will it hide all your internet traffic from local, prying eyes)
    – Will
    Feb 4, 2013 at 16:26
5

Initially the packet will contain the next destination MAC on the route to the end destination, and the IP of the end (actually, we'll say final since it sounds better) destination. How the packet is constructed, this cannot be changed. Even though the data is encrypted, you can't encrypt the destination as each corresponding node needs to know where to route the packets.

As you can see in wireshark:

alt text

The destination MAC is that of the next hop (my router), and the destination IP is that of Google.

Note:

If the connection to the destination ip (eg. Google's ip) passes through the SSH tunnel, only the ip address of the SSH tunnel can be seen in the packet NOT the ip address of Google.

Improve this answer
0
1

If you're suggesting they could read your traffic by reading your destination server's "unencrypted traffic to the internet", you need to realize that the encryption goes both ways.

But yes, a man in the middle can see that server's IP address, because otherwise there'd be no way that your packets could be routed to that server. What you'd want is an anonymous proxy service in between if you need to obfuscate the systems at each end, and not just the traffic itself.

Improve this answer
3
  • 1
    What I meant by "unencrypted traffic to the internet" is when you request a web page, and the server goes and gets it. I do understand that when that page is sent back to you, it's encrypted. But it's not encrypted when the server retrieves it from the web. So if someone could find the remote server, if they had the resources they could monitor the traffic coming out of it; not the traffic being sent back through the tunnel.
    – jonescb
    Dec 11, 2009 at 5:43
  • Then you're talking about a tunnel to a proxy, not just a general SSH tunnel.
    – phoebus
    Dec 11, 2009 at 6:20
  • 1
    that's certainly one possible use for a general ssh tunnel... heck, you could tunnel http-over-ssh-over-ssh (double tunnel) if you wanted; it's still a general ssh tunnel.
    – quack quixote
    Dec 11, 2009 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .