Using simple tools to see which websites users are connecting to

Meanwhile, "great" firewall of CN had spread to Russia, and gov folks are already versed at shutting down any home connection using most of available VPN protocols, now blanket dropping all connections using ECH, and preparing to roll out whitelist "Internet" access at any time, which they beta test everywhere on cell networks for years now.
It's a national facepalm. And a foundation for all other countries.

Why is ECH (prev. ESNI) still rarely used? It's been more than five years now. I wonder if there is some government pressure involved.

Fantastic walkthrough, thanks! Off to check it out now. Maybe you can do a followup video with more details about ECH from the standpoint of an organisation wanting to stand up multiple web sites behind one IP address and how this would work with say load balancing?

Thanks. Love these videos that use wireshark – they quite often show things I've wanted to do but hadn't had time to look into yet 🙂 Never even thought of remote tcpdump over ssh to local wireshark but that makes things so much more useful

I've always wanted a tls firewall that blocks based on certificate information.. so I could whitelist the 5 ca's I trust and a handful of server certificates.. so that I didn't have to whittle down the ca list on all the devices on my network to achieve the same goal

Man I wish I got to work with network engineers like you.
Here I am as the ms365 guy trying to explain to senior network guys how NTP doesnt set device timezones, nor does a switch clock time affect the clients on the network.

Loved it. Thanks

Quality mate

Idk why it never clicked that this is possible, but it's so obvious in retrospect

Thanks for the informative videos you produce. I still have difficulty working with wireshark. Could you look at internet radio streaming with tshark and see what we can extract from these? How do we find the url stream, that we can use in vlc, etc.

Am I correct in thinking if your demo servers were served using quic this wouldn't be visible?