(original) (raw)

Skype

Know something interesting about Skype? Drop me an email.

There has been extensive research on various aspects of Skype. Skype continues to inspire new papers. I have grouped the published papers about Skype into several categories. The link within each category is preceded by Skype version number. 'W' indicates Windows and 'L' indicates Linux.

Skype Architecture

Skype Executable Reverse Engineering

Skype Quality and Reaction to Congestion

Skype Super Nodes and Call Relays

Detecting and Blocking Skype Traffic

Skype and Encrypted Traffic

Other

Skype Security

From the Skype website

Skype and Firewalls

Skype and Softice

Skype Supernode Map

Skype FAQ

These FAQs are for v1.0.0.1 unless stated otherwise. However, most of them apply to the most recent version of Skype including 1.4.

Q: I am a system administrator and I want to block Skype. How can I do that?

You have to inspect the payload of the network (TCP, UDP) traffic. Otherwise, you cannot block Skype.

Please refer to our paper on Skype (v1.4) which explains the login procedure. Use snort or any other packet inspection tool to inspect the network traffic.

At login Skype sends a login message to the login server. The first two messages in that flow are:
Skype LS
0x1603010000 -> (5 bytes)
<- 0x1703010000 (5 bytes)

By blocking all incoming messages who have the signature 0x17030100, Skype is blocked.

Note that the first three bytes of client_key_exchange SSL message are 0x160301 which correspond to:
0x16: the message type is client_key_exchange
03 01: SSL version 3.1
Skype uses the SSL signature header for client to server message exchange. But for server to client message exchange, it uses a non-SSL based header. So by blocking packets that have this header (0x170301), one can effectively block Skype without blocking any other application.

Q: I have a lot of bw and a public IP address. My Skype client becomes a SN. How can I prevent it?

Use any network monitoring tool. I recommend net-peeker. Use it to set the upload and download bandwidth to 100 bytes/s. Make sure to check 'Also appply to UDP sessions'. Most likely your node will not become a super node i.e. it will not route calls. However, it will still receive UDP and TCP traffic from other Skype clients.

Q: Are two Skype setup executables different? (potentially a different key embedded in each setup file)

No.

Q: I logged off but did not close my Skype client. Are all TCP and UDP connections closed?

No, they are not. You must completely shut down your Skype application. Perhaps it is a bug, or perhaps it is purposely done.

Q: How many active TCP and UDP connections a Skype client has at any particular time?

When a Skype client is not in a call and is running on a machine with public IP address, it has on the average 4-8 active TCP connections and atleast one UDP connection. I noticed a string in the Skype executable dumps which mentioned that Maximum allowable connections are 10.

Q: How can I debug Skype?

Windows: You can try SoftICE. Skype does not work with SoftICE but there is a nice crack written by Gery Casiez. You can also try OllyDbg.

Linux: Skype refuses to run when run with ltrace. Skype does run with strace. Unfortunately, Skype executable hides the symbols making it quite difficult to reverse engineer.

Q: On which ports Skype listens for requests?

It listens for TCP connections on port 80, 443, and a randomly selected port (PORT) in the Skype 'Options' dialog. It uses PORT for sending and receiving UDP messages.

Q: Can I find the IP addresses of my buddies without asking them?

Try sending your buddy a Skype instant message. If there is no intermediate node, then your IM is sent to the IP address of your buddy.

Q: Are there any plain text messages in Skype?

Skype sends a HTTP 1.1 GET request to the Skype login server to check for the latest version and receives a HTTP response. There are no other plain text Skype messages.

Q: How does Skype compare with MSN, Yahoo, and Google Talk in voice quality?

We have calculated a metric called mouth-to-ear delay for Skype, Yahoo, and MSN. Skype had the best result followed by MSN and Yahoo was a distant third. Skype mouth-to-ear delay was close to 90 ms, MSN was 180 ms, Yahoo was 150 ms and Google Talk was 109 ms.

Last updated by Salman A. Baset