Dropbox uses TCP or UDP..????

[subhedarnikhil]

Hi All,

I wanted to check that whther dropbox uses TCP or UDP as a transport layer protocol..???

1. what i know is dropbox uses https then it will use TLS based encrypted traffic this is what i found in wireshark capture. Please check 108.160.172.238 as drop box ip address.

2. But when i parse these packets using ndpireader in gdb i got below stack ,

#0 ndpi_search_dropbox (ndpi_struct=0x671ec0, flow=0x7ffff00140c0)
at protocols/dropbox.c:73
#1 0x000000000040fc5e in check_ndpi_udp_flow_func (ndpi_struct=0x671ec0,
flow=flow@entry=0x7ffff00140c0, ndpi_selection_packet=0x7ffff75b7a28)
at ndpi_main.c:3222
#2 0x000000000041034f in check_ndpi_flow_func (
ndpi_struct=ndpi_struct@entry=0x671ec0, flow=flow@entry=0x7ffff00140c0,
ndpi_selection_packet=ndpi_selection_packet@entry=0x7ffff75b7a28)
at ndpi_main.c:3313
#3 0x000000000041064e in ndpi_detection_process_packet (ndpi_struct=0x671ec0,
flow=0x7ffff00140c0, packet=packet@entry=0x7ffff00196de "E",
packetlen=packetlen@entry=163,
current_tick_l=current_tick_l@entry=1490498691120, src=0x7ffff0019270,
dst=0x7ffff0019370) at ndpi_main.c:3494
#4 0x0000000000405570 in packet_processing (ip_offset=,
rawsize=, ipsize=163, iph6=0x0, iph=,
vlan_id=0, time=1490498691120, workflow=0x8ee420) at ndpi_util.c:547
#5 ndpi_workflow_process_packet (workflow=0x8ee420,
header=header@entry=0x7ffff75b7bc0,
packet=packet@entry=0x7ffff00196d0 "`\244L\205\273\200\234\267\rn\230\225\b" ) at ndpi_util.c:900
#6 0x0000000000401fa7 in pcap_packet_callback_checked (args=,
header=0x7ffff75b7bc0,

If we can see #1 frame , it uses check_ndpi_udp_flow_func() and then it calls dropbox functions how come it is possbile..???

Can anyone help me..????

Regards,
Nikhil

[kYroL01]

@subhedarnikhil Dropbox, like other applications, can use both protocol TCP and UDP.
Usually UDP is used to sync between Dropbox client and Dropbox server, while the data transfer flows in secure HTTP (TLS).
So basically there is no issue. It's the Dropbox behaviour and nDPI try to recognize it and detect it.