[CentOS] two questions about ssh tunneling

[Les Mikesell]

Tudod Ki wrote:
> if I:
> 
> ssh -fND localhost:6000 somebody at 192.168.56.5 -p PORTNUMBER
> 
> from computer "A" to computer "B" [B = 192.168.56.5] then I can set the 
> SOCKS proxy for e.g.: Firefox to use "localhost:6000" on computer "A". 
> Ok. I can surf the web through "B".
> 
> But:
> - Can anyone sniff the traffic of "A"? [e.g.: computers on same subnet 
> as "A"] Like DNS requests? - I think no, but I'm not sure :O

The packets between A and B will be be visible only as encrypted ssh 
packets.  DNS lookups will depend on the client socks protocol.  Socks4 
did the lookups on the client and was extended as socks4a to do dns on 
the server.  Socks5 lets the server handle dns.

> - Can anyone sniff the traffic of computer "B"? e.g.: B computer is at a 
> server farm [others in the farm can see the traffic?] - I think yes, but 
> I'm not sure :O

The A-B connection will appear here as well, as encrypted ssh packets. 
The proxied outbound connections will be unencrypted but will appear to 
originate from B.  If you are the only one connected it wouldn't be too 
hard to deduce what is going on - and the packets will mostly correspond 
one for one timing wise.  So, the connection wouldn't be obvious, but I 
wouldn't count on not getting caught if you are doing something illegal.

-- 
   Les Mikesell
    lesmikesell at gmail.com