2

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate between the two. According to my concept, they're both a flow of http packets so they should not be differentiable.

Furthermore, If I start downloading from proxysite.com (it encrypts all the traffic), the firewall couldn't differentiate and allows me to download even tens of GBs of data. Can you explain what exactly is going on here?

7_R3X
  • 606
  • 3
  • 12
  • 25

1 Answers1

4

The firewall installed at my college's router allows me to surf the internet but never allows me to download any package that has a size more than 100mb. I wonder how exactly does it differentiate between the two. According to my concept, they're both a flow of http packets so they should not be differentiable.

I presume they are intercepting your traffic and basing this filtering off the HTTP header Content-Length or dropping the connection after so many bytes.

Furthermore, If I start downloading from proxysite.com (it encrypts all the traffic), the firewall couldn't differentiate and allows me to download even tens of GBs of data. Can you explain what exactly is going on here?

This would seem to reinforce my very-likely theory. If a site were using HTTPS, they would not be able to intercept the header or otherwise see what you are doing with a server without first installing a root certificate on your machine to MITM the HTTPS traffic.

Alexander O'Mara
  • 8,774
  • 6
  • 34
  • 38
  • That was a quick and brilliant answer. Explained me everything I was looking for but just one last thing. After reading your answer I visited backbox.org again and saw that they're using https but I'm still not able to download the iso. I figured out the reason though. The site uses https for browsing but not for downloading and same is the case with many other sites. Could you please tell me why does everyone configure the server this way? – 7_R3X Jun 02 '16 at 06:40
  • 1
    @7_R3X that's an interesting question, which has already been answered here: http://security.stackexchange.com/questions/18853/why-arent-application-downloads-routinely-done-over-https – A. Darwin Jun 02 '16 at 06:43