System and method for decoding traffic over proxy servers
Methods and systems for applying surveillance to client computers that communicate via proxy servers. A decoding system accepts communication packets from a communication network. Based on the received packets, the decoding system identifies that a certain client computer conducts a communication session with a target server via a proxy server. The decoding system processes the packets so as to correlate the identity of the client computer with the identity of the target server. The correlated identities may comprise, for example, Internet Protocol (IP) addresses or Uniform Resource Locators (URLs).
1. A method, comprising:
receiving communication packets from a communication network;
identifying at least some of the communication packets as belonging to a communication session that is conducted between a client computer and a target server via a proxy server;
modifying at least some of the identified communication packets to represent an artificial direct session between the client computer and the target server, which does not traverse the proxy server;
decoding the modified packets so as to reconstruct the artificial direct session; and
presenting the reconstructed artificial direct session to a surveillance operator.
2. The method according to claim 1 , further comprising correlating a first identity of the client computer with a second identity of the target server, wherein an indication of the second identity is encoded in one or more of the communication packets that are exchanged between the client computer and the proxy server, and wherein correlating the first identity with the second identity comprises decoding the indication.
3. The method according to claim 1 , further comprising correlating a first identity of the client computer with a second identity of the target server, wherein the client computer communicates with the proxy server over a first Transmission Control Protocol (TCP) tunnel, wherein the proxy server communicates with the target server over a second TCP tunnel, and wherein correlating the first identity with the second identity comprises decoding at least one of the first and second TCP tunnels.
4. The method according to claim 1 , wherein the proxy server comprises a Hyper-Text Transfer Protocol (HTTP) proxy server.
5. The method according to claim 1 , wherein the proxy server operates in accordance with a SOCKS protocol.
6. Apparatus, comprising:
a network interface, which is configured to receive communication packets from a communication network; and
a hardware processor, which is configured to identify at least some of the communication packets as belonging to a communication session that is conducted between a client computer and a target server via a proxy server,
wherein the processor is configured to modify at least some of the identified communication packets to represent an artificial direct session between the client computer and the target server, which does not traverse the proxy server, to decode the modified packets so as to reconstruct the artificial session, and to present the reconstructed artificial direct session to a surveillance operator.
7. The apparatus according to claim 6 , wherein the processor is further configured to correlate a first identity of the client computer with a second identity of the target server, wherein an indication of the second identity is encoded in one or more of the communication packets that are exchanged between the client computer and the proxy server, and wherein the processor is configured to correlate the first identity with the second identity by decoding the indication.
8. The apparatus according to claim 6 , wherein the processor is further configured to correlate a first identity of the client computer with a second identity of the target server, wherein the client computer communicates with the proxy server over a first Transmission Control Protocol (TCP) tunnel, wherein the proxy server communicates with the target server over a second TCP tunnel, and wherein the processor is configured to correlate the first identity with the second identity by decoding at least one of the first and second TCP tunnels.
9. The apparatus according to claim 6 , wherein the proxy server comprises a Hyper-Text Transfer Protocol (HTTP) proxy server.
10. The apparatus according to claim 6 , wherein the proxy server operates in accordance with a SOCKS protocol.