Internet Protocol - Research by Kirils Solovjovs

Skype protocol 76
• The external port numbers or IP address are not derivable, because NAT rewrites them,
• The firewall and NAT in use prevents the session being received
• UDP is not usable due to NAT issues, such as timeout
• firewalls block many ports
• TCP through many to one NAT is always "outward only" by default - Adding Port Forwarding settings to the
NAT router can allow receiving TCP sessions
Supernodes are grouped into slots (9-10 supernodes), and slots are grouped into blocks (8 slots).
Protocol
Signaling is encrypted using RC4; however, the method only obfuscates the traffic as the key can be recovered from
the packet. Voice data is encrypted with AES. [4]
The Skype client's application programming interface (API) opens the network to software developers. The Skype
API allows other programs to use the Skype network to get "white pages" information and manage calls.
The Skype code is closed source, and the protocol is not standardized. [5] Parts of the client use Internet Direct (Indy),
an open source socket communication library.
8 July 2012, a searcher from Benin, Ouanilo Medegan, released articles and a proof of concept client source code,
results of reverse engineering on the Skype client [6] .
Protocol detection
Many networking and security companies claim to detect and control Skype's protocol for enterprise and carrier
applications. While the specific detection methods used by these companies are often proprietary, Pearson's
chi-squared test and stochastic characterization with Naive Bayes classifiers are two approaches that were published
in 2007. [7]
Preliminaries
Abbreviations that are used:
• SN: Skype network
• SC: Skype client
• HC: host cache
Skype client
The main functions of a Skype client are:
• login
• user search
• start and end calls
• media transfer
• presence messages
• video conference