Application Signature Detail

VOIP: Skype Traffic

This signature detects Skype, which is a proprietary P2P VOIP network. It is a "complete black box" for both users and analyzers. It uses security through obscurity to make itself troublesome to analyze or reverse-engineer without a significant amount of work, or use of emulation. It uses AES block cipher, the RSA public key cryptosystem, the ISO 9796-2 signature padding scheme, the SHA-1 hash function, and the RC4 stream cipher through the communications between the client to client, client to supernodes and supernode to supernode.

References

• URL: http://en.wikipedia.org/wiki/Skype