Does SSL inspection analyses WebSocket traffic?

Hi ff9394611 ,

Thank you for reaching out to the community, websocket traffic inspection  in proxy mode will be a feature request as of now - OWP-I-743.

Where as DPI mode lets Websocket traffic pass without problems.

Additionally you can refer - Sophos Firewall: Web filtering basics & HTTPS decrypt and scan FAQ.

Hello Vivek,

Thank you very much for the prompt answer.

So, if using DPI, will WebSocket traffic get inspected? Security-wise is an important point. Maybe the customer will use DPI and not Proxy, the project is still open. 

Yes, DPI engine detects and filters HTTP and SSL/TLS traffic on any port. Web proxy transparently handles traffic only on TCP ports 80 and 443.

Careful. 

DPI Engine is only for Internal to External.

WAF is for external to Internal (Reverse Proxy). 

WAF cannot inspect WebSockets, but it can bypass them. 

Hi ff9394611 In terms of documentation you will get information in the below help section:

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=rules-policies-WAF-add

Hey thanks for clarifying that. I don't want to do anything with WAF, this is strictly for users surfing the web. 

I guess my question has now evolved to Web Proxy vs DPI engine, in which case will an attack over a WebSocket be prevented? 

Thanks again for your help.

So, to conclude, if I use the DPI engine, an attack over a WebSocket communication will be prevented? That would seal the deal. 

This is for WAF, my question concerns Web Protection. But thanks for answering anyway ;)