Detailed Investigation of Packets and Segments in Encrypted Video Streams

Requirements: We were asked as part of a patent case to capture and evaluate video streams to demonstrate segment time alignment and variance in playback delay of a live broadcast across a diverse set of networks.


The client required the ability to demonstrate that when streaming video across a network with variations in bandwidth, a high bandwidth video stream segment would match the division timing of a lower bandwidth segment from the same stream. We assembled an apparatus that allowed us to manipulate the speed and quality of an internet connection as well as capture and decrypt the SSL/TLS encrypted video streams entering the network. Evaluation of the video streams demonstrated that segments were, in fact, aligned.

The client also required demonstration of delay variance between different networks for streaming of live events. We constructed a test apparatus that allowed for the filming of simultaneous playback of a live event on three different devices over distinctive networks. A display was connected to a cable box and showed a live event as it was being broadcast over a cable TV network. An iPad showed the same event being streamed over the cable provider’s app via Wi-Fi. An iPhone acted as the third display and showed the event being streamed over the cable provider’s app via LTE. The video of this test clearly demonstrated the variability in time delays between the various networks used to stream the live event.

Tools used: MiTMProxy, HoneyProxy, dnsmasq, SSLSplit, tcpdump, tc, iptables, FFmpeg, hostapd,  OpenVZ, Xen, iPerf3, Debian, Ubuntu, CentOS

Techniques used: SSL interception, modification, and replay system; Packet capture; Traffic control and network impairment; Mpeg decoding and inspection tools; Virtualization environments