You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.
I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet
Right, I guess as more DoH servers become available, it’ll be harder to track, but you could intercept and blackhole any HTTPS traffic to one.one.one.one and other popular servers to have them fallback.
Could you block DoH entirely on the network level and cause it to fallback? I guess you’d have to have a list of common DoH IP addresses to block.
You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.
I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet
Right, I guess as more DoH servers become available, it’ll be harder to track, but you could intercept and blackhole any HTTPS traffic to
one.one.one.oneand other popular servers to have them fallback.