Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I downloaded it just to check it out, since the concept (showing that many websites need to go to SSL) was pretty cool. I was wondering, however, what the filter was and how does tcp port 80 differ from anything else.

share|improve this question
Port 80 is what's used for all web traffic. – Sathya Jan 26 '11 at 5:57
up vote 3 down vote accepted

TCP port 80 is the port you send HTTP requests to on a webserver. This is as opposed to TCP port 443, which is used to carry HTTPS (SSL-encrypted) traffic. Because SSL-encrypted traffic is encrypted using a key that only the webserver posesses, you cannot easily determine the contents of requests going to a server on port 443, in most cases. on port 80, though, traffic is being sent in plaintext (easily readable), so it's trivial to see what's in the requests, even if they're someone elses. All websites that require you to sign in should be taking advantage of SSL, unfortunately many aren't.

As far as filters, firesheep starts off by capturing every single packet that travels across the network. Once it's done that it needs to find out what packets are interesting. This is the filtering process. Although I don't know how Firesheep actually works, it probably starts out by looking for requests to websites it's familiar with (e.g. facebook), and it then looks for requests that look like a login attempt. It knows the format of the facebook login form, so it can just pull out the 'username' and 'password' fields from the packet.

share|improve this answer
Firefsheep actually doesn't even need to sniff the login attempts - facebook does use https for login. It just needs to grab the headers off of any valid request to facebook, then it takes the cookie data from the header and sends that cookie itself, thus impersonating the already-logged in user, without ever having to sniff login details. Thus any access to facebook works, not just logins. – nhinkle Jan 29 '11 at 9:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.