How can Skype voice traffic be detected?  I would like to set QoS
and/or filtering rule on Skype traffic.

---

Clarification of Question by michaelchan-ga on 08 May 2005 22:03 PDT

As the protocol is encrypted, I would expect the answer needs to use of libpcap.

The detection platform that I want to use is Linux.

And I want to detect voice traffic.  Not control traffic.

I don't think it is possible to block Skype or change QOS.

If you try to block the typical way Skype connects, it will just
connect through the Super Node.

I do not know in detail how it works, but each Skype client on the net
who has a public IP becomes part of the Super Node.  These nodes
facilitate the communication between Skype clients.

Because their as so many different nodes, you could never possibly block them all.

Libpcap is not going to do much for you because nearly all Skype
traffic is encrypted.  If perhaps someone does figure out a way to
detect Skype packets, as soon as the information is publicly
available, Skype will change their program to communicate in a
different manner.

This type of software is quite disturbing to security professionals
because the risk to the internal network is great.  There is not an
easy way to reduce this risk, even if you block all outgoing to
traffic to ports other than 80, 443, etc.  The super node most likely
has servers listening on these ports as well.

Here is some more info
http://www1.cs.columbia.edu/~salman/skype/

Is it possible to detect by using pattern match?  E.g. handshake
behavior, packet size, header, etc.  I would accept the success
detection rate to be a little less than 100%.  And I also accept a
connection is detected AFTER a few packets are sent instead of during
TCP establishment.

Not sure if this will help, but I noticed the following article
"Popular packet analyzer doesn?t recognize Skype traffic" at
http://blogs.zdnet.com/ip-telephony/index.php?p=417

Likewise, this PDF contains a good analysis of the Skype protocol, which may help.

Finally, the Skype handbook for network administrators might contain
the information you are looking for at:
http://www.skype.com/security/guide-for-network-admins.pdf

Of course, if you are ever looking for anything related to Skype you
can come check out my web site at http://www.summitcircle.com/

Louis Philip
Find a Skype phone, add-on or 
community at http://www.summitcircle.com/

I believe CheckPoint Software's firewall has the ability to detect and
block Skype traffic or simply apply QoS to it. At least that's what
they told me when I had a phone briefing with them.

They may not be a "free" Linux solution, but it will do the job.

Hope this info helps.