Finding TLS host server name using Wireshark and blocking Facebook on Mikrotik using TLS Host

hi there this is mar haddad in this video i have to show you how you can find the tls host for a website that you are visiting for example let's imagine that we are visiting facebook.com or visiting twitter.com and we really want to apply some filtering rules on those websites so that means we want to for example block them but maybe we want also to make some quality of service on them applying some queuing so we know that it's possible that you can do the layer 7 so if you want i can just show you here on ip on firewall you have something called layer 7 protocol so over here you can do the layer 7 protocol and then you have to write a regular expression over here but the problem is that the democratic router every time you are connecting to the internet and searching for something it will always look for layer 7 to look if this is for example facebook or to this twitter and this will take a lot of resources on your uh micro tech router so your cpu becomes high and when you have a lot of traffic then they are already your your cpu is high then also looking on layer 7 then this will cause dropping for package for this reason we on the microtech there is uh starting the version the 6.41 there is an option that you can use the tls host so this is something you can see it over here on the advanced if you look over here you have the dls host that is if you want to do the firewall so here you put the dls host off the facebook.com so you may have you make you have to search for that so that you have you have to find the tls matching for it and then you put it here and then in this case if someone go to the facebook.com for example it will be stopped same for twitter but also you can apply it if you want to do some quality of service you can apply it on mangling so i have here already one applied and and you can see that i have used here the tls host which is star.facebook.com so this will be applied for quality of service and then i make a queue here and on this queue i make the limitation all right so now in this video i just want to show you how you can find or make the match up for the tls host so how to find it and that's something that not a lot of people knows about it so i'm going to show it to you how you can find for example the tls host matchup or facebook.com all right so to do that first you need to be connected to the internet so in my case i have this microtech router it is on the internet and my computer is connected to the internet on this microtech router so what we need to do is to do some type of packet sniffer so we have to sniff the package that are going to from my computer to the router and also coming all right so because on my computer later i want to open for example facebook.com so if you see now if i go to my computer if i do ipconfig you'll see that the ip of my computer is 192.8.1.254 and in my ping google.com you see that i'm able to go to the internet all right so i'm able to go to the internet from this computer via this router which i have it here the micro tech router all right so we have to go to tools and then we go to packet sniffer and over here we want to save this sniffing that i'm going to do in a file let's call it for example capture all right so i will call it this file name is called capture streaming i don't do anything filter here i have to select the interface so the lan interface in my case is the bridge interface and then we have to say the ip which is my computer ip192.1.254 that's what we have seen this is the computer ip and then i'm going to snip what the tcp on the port 443 because facebook works on tcp port 443 so i want to snip that and hit direction and make it any and filter by default it is on or you just put it on end and then that's it you say apply all right so that's what i need to do then i will say start so sniffing has started directly now i go to my browser in the background now i'm on my browser and i'm opening facebook so i just clicked on facebook now and facebook is open and i'm not showing that for you because this is my personal facebook so i just want to keep it confidential and then i'll just do some browsing on my facebook i'm doing that on another screen so now it's done i made a couple of browsing on the facebook and now what i need to do is just to say here stop so that's what i need to do now if we go to the file we can see that we have here the file which is called capture it is there excellent so now what i need to do for with this file i just want to copy it and let's put it on the desktop here so i move it and i put it on my desktop alright so now what we need to do is to analyze this capture file and to analyze it we have to use wireshark because from the wireshark i can see the server's names that are used on the tls so we have to go to washock so let's open y-shark so this is why shark now opened and all i need to do is to take this one and paste it to wireshark very good so we have all those information but we don't want all those information what you need now to do is to put here in a filter you have to write this so i have already this over here i will leave it for you as well ssl.handshake.extensions underscore server underscore name so this will show me the server names of facebook so once you do that you see it will show you click client hello all right so what you need to do you can see that this destination this is an ip this is another ip that is another ip so we can check the one which have different ips to find out the tls host server name now we go to this one we open the first one now over here we have to check on the transport layer security that's the tls and then i open this one as well then we go down to handshake protocol client hello i will click on it and now we have to look to the extension which is the server name you see it over here so this one and now over here you click on server name indication extension and you can see this is the server name static dot xx dot fb cdn facebook cdn.net so this is one all right let's check another one so we go for example to this one and we go down dls also handshake and the server name over here it's www.facebook.com all right facebook.com now we check another one let's check this one so we go down extension server name and this is say going to some other server which is the messenger live so that's not really important so let's go to another one so this one we have seen it once 57 to 40. this is the 13 we didn't see it so let's open this one and now we go down down down to the extension server name so again it's facebook cdn so uh yeah you can see you can gather all of those and you can use them when you want to create your virtual rules or you want to do some like queuing you can use all those class hosts let's check check also this one and let's go down so as well you see this facebook cdn.net all right so what you can do is just easily maybe i can also show you this directly now so over here what you can do if i just want to show you that let's open the browser in front of you but i will not log into my facebook account so if you go to facebook.com you can see it's possible so what you can do if you want to block facebook for example you can just go to ip firewall and on the filter rules i will create one forward chain and the protocol is we said the tcp the destination port is 443 on the advanced i will say here the tls host i can use the tls host that i have seen of for facebook.com but i also have tried this one and it's working it's just a mcstar dot facebook.com so anything which is uh from the domains facebook.com star means anything before that then this will match so this is tls.host and then action i will say here drop and that's it and then now if i say okay all right so that's all i need to do and then what i need now to do is to just go to the connections because the facebook.com server is already open now the connection for it so i just delete the connection and now if i go back to here and i write facebook.com let's have a look so it's not opening and look here you see that the bytes and packets are increasing why because this firewall rule is working and it's dropping now facebook.com so you can see it's not working and if we look now it's still ongoing ongoing and you will see at the end it's not gonna work and that's uh what the the tls host can do you can see it's very efficient so you see just i made here the tls host start at facebook.com action is to drop on the forward chain i put the tcp and the https and then you see that facebook.com is not working now you can also if you want to find out the tls host for any other websites all you need to do is the way that i have showed you and then this will work perfectly for you so you can see that now facebook.com is not open so this is what i wanted to show you about the tls host matchup so you can see that using the wi-shark we can do the tls host matchup to be able to find the tls host for for example facebook.com or for any other website that we want but of course you have to try a lot because it may be for example for youtube they have many many many servers so you can try this a lot of time and collect all the service name and then you can use them inside the tls host and this is much better for your micro tech router than using the layer 7 protocol using the regular expression because with this one it will concept a lot of processor on your microtech router so this is what i wanted to show you in this lecture also i will leave for you in this video a link about how to limit facebook.com i have a post for that so i will leave this for you on a link you can go for it and you can read using the tls host how to limit the bandwidth for facebook.com so this is what i wanted to show you in this video i hope it was informative for you and i will see you in some other videos

Channel: MAICT Consult

Views: 3,694

Keywords: MikroTik, MTCNA, wireshark, wireshark tutorial, Maher Haddad, mikrotik block facebook layer 7, mikrotik block facebook and youtube, Mynetworktraining, how to block facebook mikrotik, bloquear facebook mikrotik 2019, mikrotik facebook video streaming, block facebook mikrotik, mikrotik facebook, mikrotik block facebook https, how to block facebook mikrotik layer 7, mikrotik facebook speed, mikrotik facebook layer 7, mikrotik l7 regex facebook, mikrotik firewall facebook

Id: cFtZNbY-2Qo

Length: 11min 38sec (698 seconds)

Published: Wed Aug 26 2020