2

Need help to understand what's happening on TCP level when http proxy is used.

When client wants to open a website through a proxy, first connection is established between client and proxy. Then proxy just transfers the traffic between client and destination server in both ways. On HTTP level, server sees the exact same data that client sent (e.g. for HTTPS connection).

The question is: is it true for a lower TCP level? Does server receives the exact same TCP packets that were sent from client, or proxy server can rebuild them before passing to the destination server? Another way to question this: if client is a Windows machine with configured TTL=128, TCP window size=65535 and the proxy server is a Linux server with TTL=64 and window size=5840, what will the destination server see?

Improve this question
4
  • Depends on exactly which proxy (or type of proxy) you are referring to...some proxies are largely transparent, others can do a lot more (caching, HTTPS inspection/offloading, etc). There are also differences between a proxy used by clients for access to network/Internet resources and a proxy that is used for load balancing (i.e. application delivery controllers) to multiple servers.
    – YLearn
    Jul 3, 2019 at 17:46
  • @YLearn, thanks. I was talking about popular proxy services like Luminati/Oxylabs/Microleaves who provide so called "residential" proxies - there's some software installed on real users computers, typically there's some gateway for the clients that routes the traffic to real proxies. Can this question be answered, or it still depends and I should contact the support?
    – AdamSkywalker
    Jul 3, 2019 at 18:05
  • Not familiar with them myself, but I would presume they are at least providing some sort of caching service at a minimum. They are also probably collecting meta data, but that is another issue entirely.
    – YLearn
    Jul 3, 2019 at 18:08
  • In general, the TCP segmentation on the server side is unrelated to that on the client side -- there's no necessary connection between the MTU on each side, for example, and as the link speeds, latency, and throughput are likely to be different, windowing will be different. And that's before any lost packets, fragmentation, slow start. You can fiddle with the packets at the level of NAT, but any real proxy will have different input and output packets.
    – jonathanjo
    Jul 4, 2019 at 18:15

1 Answer 1

Reset to default
3

A proxy is usually a user space program which maintains independent TCP connections to the client and to the server. While the application layer payload might be left unchanged by the proxy (or not, proxies often add some HTTP header like Via and/or X-Forwarded-For) the original TCP packets are not simply passed through but new packets are created.

With the typical non-transparent proxies these new packets contain a different source and target IP and port than the original packets. They also might packetize the application payload in a different way. For example the original client might have send a small HTTP POST request in one packet while the proxy might make two packets out of it: one containing the HTTP header and one the HTTP body.

Some proxies can run in a destination transparent mode. In this case the original destination IP and port is kept, but source IP and port changes. And some proxies can run in a full transparent mode where additionally the source IP and port are kept. But in all of these cases the proxy might packetize the data in a different way. And even if the payload of the packets is kept the same the TCP sequence numbers will very likely differ.

Contrary to this DPI (Deep Packet Inspection) as found in IDS/IPS works at the packet level. It will analyze the application layer payload (like a proxy does) but then forward the original packet (unlike a proxy), usually unmodified or at most marginally modified (changing some bytes but keeping the size).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.