Unit 6: HTTP and TLS on the wire · Lesson 4 of 5 · 20 min

AI traffic on the wire

Find which AI services the office talks to, compare them with the approved list and measure what was sent.

mission

You are
The analyst enforcing the AI use policy.
Situation
corp.example allows one AI assistant, run in a company tenant. Data protection suspects staff paste documents into other chatbots and AI APIs.
Goal
From egress.pcap, list every AI service in use, check each against ~/inventory/approved-ai.txt and measure the uploads.
Hand in
The unapproved service, the laptop using it and how much it sent.

AI traffic leaving the office

01

Read the policy

Start from what is allowed. Everything else is a question.

analyst@net-lab
cat inventory/approved-ai.txt
Approved AI services, reviewed 2026-09-15

chat.ai-assistant.example   company tenant, SSO, prompts not used for training
02

Find AI services by name

SNI filters accept contains. Search for the words AI services tend to use in their names, then read the list by eye.

analyst@net-lab
tshark -r egress.pcap -Y 'tls.handshake.extensions_server_name contains "ai-" || tls.handshake.extensions_server_name contains "llm"' -T fields -e ip.src -e tls.handshake.extensions_server_name | sort | uniq -c
      3 10.10.0.23	chat.ai-assistant.example
      1 10.10.0.31	api.llm-vendor.example

you should see One approved service, one that is not on the list.

defender tip Keyword searches miss services with plain names. In real work, compare every SNI against a maintained list of AI domains, which secure web gateways and DNS filters already ship.

03

Measure the upload

A chat prompt is a few kilobytes. A document upload is hundreds.

analyst@net-lab
tshark -r egress.pcap -q -z conv,ip,ip.addr==198.51.100.140 | sed -n '6p'
10.10.0.31           <-> 198.51.100.140            15 12 kB         212 293 kB        227 306 kB       95.000000000         0.0718
tshark -r egress.pcap -q -z conv,ip,ip.addr==198.51.100.141 | sed -n '6p'
10.10.0.23           <-> 198.51.100.141            39 28 kB          36 14 kB          75 43 kB        20.000000000       110.0274

you should see laptop-akim sent 293 kB to the unapproved API in under a tenth of a second. The approved assistant received 14 kB of prompts.

Two kinds of AI use

Unapproved
10.10.0.31 -> api.llm-vendor.example
293 kB out in one session
no tenant, no SSO, unknown retention

A document left the company. Find out which one and talk to the user.

Approved
10.10.0.23 -> chat.ai-assistant.example
14 kB out over 3 sessions
company tenant, SSO, logged

Normal use of the sanctioned tool.

04

Count AI sessions per laptop

Group the AI sessions by client to see who to talk to.

analyst@net-lab
tshark -r egress.pcap -Y 'tls.handshake.extensions_server_name contains "ai-" || tls.handshake.extensions_server_name contains "llm"' -T fields -e ip.src | sort | uniq -c
      3 10.10.0.23
      1 10.10.0.31

you should see Two laptops use AI services: 10.10.0.23 with three sessions and 10.10.0.31 with one.

What a defender takes away

  1. 1SNI and byte counts are enough to enforce an AI policy without breaking encryption.
  2. 2Upload size separates chatting from pasting whole documents.
  3. 3The best control is a good approved tool. Blocking alone pushes people to phones and home laptops.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    Compare the SNIs with approved-ai.txt.

  2. Show hint

    ip.src on its Client Hello.

  3. Show hint

    conv,ip,ip.addr==198.51.100.140 and read the -> Bytes column.