finger-sniffer

What it is

finger-sniffer accepts connections on a set of captured ports and records how they arrived: IP and TCP details (TTL, SYN options, JA4T, p0f guess, RTT, retransmissions, how the connection was closed), the TLS ClientHello and its fingerprints, the exact HTTP bytes, DNS queries and timing. Everything is returned, raw and analysed, through an API on ports that are not captured.

Use it to find out whether your traffic is intercepted on the way (proxies, middleboxes, TLS inspection) and which characteristics it has when it reaches the server.

Before you start

All traffic is public. Anything you send to the captured ports, including headers, cookies and request bodies, can be read by anyone through the API. Do not send secrets. Records are kept for about 10 minutes and then deleted.

This server is shared: it also hosts other sites behind the reverse proxy on ports 80 and 443. Everything that reaches the server's network interface is captured, including the traffic of those sites (addresses, TLS server names and plain HTTP requests on port 80), and is public through the API for the same 10 minutes.

Live feed

Every connection, HTTP request, DNS query and stray packet that reaches the mirror, from everyone, a moment after it is recorded. The feed comes from the API on port 9000, so watching it does not create captured traffic. Times are in UTC. Click a connection to see its full record (pause the feed first if it moves too fast).

Waiting for events.

Captured ports

Ports 9000 (HTTPS) and 9001 (HTTP) on finger-01.badblock.net.br serve the API and are not captured. Ports 80 and 443 belong to the reverse proxy of the server, not to the mirror: always put the port (:8443 or :8080) in the URL of a probe.

How to probe

Pick a random probe ID of 8 to 32 lowercase letters and digits (for example k3x9q2mz7a) and use it both as the leftmost DNS label and in the path. The DNS lookup, the TCP and TLS handshakes and the HTTP request are then all tied to the same probe:

curl https://k3x9q2mz7a.finger-west-01.badblock.net.br:8443/p/k3x9q2mz7a/

The response is a short text with the conn_id of your connection. The response can be controlled through /p/<id>/r?..., for example:

curl 'https://k3x9q2mz7a.finger-west-01.badblock.net.br:8443/p/k3x9q2mz7a/r?status=204&conn=close'
curl 'https://k3x9q2mz7a.finger-west-01.badblock.net.br:8443/p/k3x9q2mz7a/r?size=100000&frame=chunked'
curl 'https://k3x9q2mz7a.finger-west-01.badblock.net.br:8443/p/k3x9q2mz7a/r?delay_head=500&h=X-Test:1'
curl --http3-only https://k3x9q2mz7a.finger-west-01.badblock.net.br:8443/p/k3x9q2mz7a/
curl http://k3x9q2mz7a.finger-west-01.badblock.net.br:8080/p/k3x9q2mz7a/

On the raw TCP ports, send a PROBE <id> line first (optionally with mode=echo|banner|sink|source and n=N):

printf 'PROBE k3x9q2mz7a\r\nhello\r\n' | nc finger-01.badblock.net.br 7

Where to see the result

Ask the API for everything recorded under your probe ID. wait holds the answer until all connections of the probe are closed (up to 60 s):

curl 'https://finger-01.badblock.net.br:9000/api/v1/probes/k3x9q2mz7a?wait=10s'

The same API is available over plain HTTP on port 9001 (http://finger-01.badblock.net.br:9001/api/v1/probes/<id>). Each connection also has its own record, raw bytes and a pcap: /api/v1/connections/<conn_id>, /api/v1/connections/<conn_id>/raw and /api/v1/connections/<conn_id>/pcap. When you are done, DELETE /api/v1/probes/<id> removes your records before the 10 minutes.

API reference

The full contract (OpenAPI 3.1) is at https://finger-01.badblock.net.br:9000/api/v1/openapi.yaml (also over HTTP on port 9001). It covers connections, raw bytes, pcaps, DNS queries, stray packets, health and the live event stream.