DNS, HTTP & TLS

1 DNS: a question and an answer

Before a client connects to www.example.org it asks a resolver for the address, usually over UDP port 53. Query and answer share a 2-byte transaction ID. Names are stored as labels: a length byte, then that many characters, ending with a zero byte. www.example.org becomes 03 77 77 77 07 65 78 61 6D 70 6C 65 03 6F 72 67 00.

The answer repeats the question and adds a resource record. Its name is just C0 0C: a compression pointer (top two bits set) to offset 12 of the DNS message, where the question's name starts. The record also carries a TTL: how long caches may keep it.

2 HTTP: plain text on the wire

Unencrypted HTTP is readable line by line: a request line (method, path, version), headers, an empty line, an optional body. The Host header names the site; User-Agent names the client software, which helps to tell a browser from a script or an update service.

Plain HTTP is rare for websites today, but common for update checks, telemetry, internal devices, printers and old applications. Whatever travels in plain HTTP (query strings, cookies, form fields) is visible to every capture point and in every proxy log.

3 Through a proxy

In companies, browsers often talk to an explicit proxy instead of the server. The request line then changes:

For HTTPS the proxy sees only the host and port in the CONNECT line, then relays encrypted bytes. Unless it does TLS inspection (decrypting with a company certificate), its log has no path, no file name, no content, only the volume in each direction and the duration. Many companies exclude categories such as banking, health or personal webmail from inspection for privacy reasons; the proxy configuration tells you which.

Proxy logs usually write one line per request when it ends. A tunnel that stayed open for 20 minutes appears at its end time, with the duration in a separate field. Subtract it to get the start.

4 TLS: what encryption leaves visible

A TLS connection starts with a ClientHello in clear text. It contains the SNI (server name indication: the host name the client wants), the protocols it can speak inside (ALPN: h2, http/1.1), and long lists of cipher suites and extensions that differ between browsers, libraries and tools.

The JA3 fingerprint is an MD5 hash over the ClientHello's version, cipher suites, extensions, groups and point formats. The same software produces the same JA3, so it can link connections made by the same client program, or show that "the browser" was in fact a script. It does not identify a person. (JA4 is a newer, more robust variant.)

Direction and volume tell a lot: a session where the client sends hundreds of megabytes and receives a few kilobytes is an upload, whatever the content. Watch out for DNS over HTTPS (lookups hidden inside HTTPS), QUIC (HTTP/3 over UDP 443) and Encrypted Client Hello, which remove some of these traces.

5 Try it yourself

Answer from the hex views above.