Using Byte25 to Classify Microsoft Application Traffic

Byte25 Application Classification

Identifying & Classifying Microsoft Traffic

Microsoft applications, and in particular Office365, are pervasive across most enterprise environments. The ability to report on usage and performance of individual Microsoft applications is important to maintain good user experience and to diagnose and resolve issues.

Microsoft applications typically utilise an encrypted transport protocol (TLS over HTTPS) making tradition deep packet inspection classification mechanisms impossible. To address this, Byte25 have implemented several techniques that allows for the identification and classification of individual Microsoft applications to provide visibility for reporting and troubleshooting.

The following document summarises the techniques and capabilities Byte25 deploy to achieve detailed visibility of Microsoft applications

Summary of Capability

The Byte25 appliance classifies Microsoft applications into broad application groups identifying the most common Microsoft business applications as listed here:

Within each application group there are a number of sub-groups based on specific Microsoft URLs that allow for further classification of other Micosoft applications (e.g. Sharepoint, Outlook etc). A complete list of sub-groups is provided in Appendix A.

On the Byte25 clioud dashboard, filters can be applied to any application group or sub-group to identify specific usage, users or conversations. For example, if Sharepoint traffic is of particular interest, it is a simple matter to apply a filter to just show Sharepoint traffic, with all normal Byte25 metrics available such as throughput, top talkers, conversations, latency and so on.

Additionally, each application group and sub-group is classified using the standard Byte25 Category and Rating framework to provide high level summaries of network usage.

TLS Certificate Inspection

Encrypted traffic, such as Microsoft Office365 using Transport Layer Security (TLS) over HTTPS[1], is difficult to classify as the payload in encrypted preventing deep packet inspection. To circumvent this, Byte25 use certificate inspection to identify the owner of the destination server.

 Figure 1. Sample Certificate Owner Chart

The above chart shows an example of the Top 30 Certificate Owners and Organisations available from the Application Summary tab from the Byte25 Performance dashboard. We can clearly see 2 certificate ‘owners’ relating to Microsoft; one for Microsoft Corporation and the other for Microsoft. Selecting either of these entries will apply a filter on the Byte25 dashboard to isolate just Microsoft traffic.

Once selected, looking at the Application Type chart (from the Overview tab on the Performance dashboard), we see just the Microsoft Applications.

 Figure 2. Application Type with Microsoft Certificate Owner Filter

In our example, we see entries for Office365, Skype[2], MSN and MS_OneDrive.  That is, Byte25 specifically classifies individual Microsoft applications even though they all share the same encrypted HTTPS transport protocol. Note that these are just the applications visible in our example, refer to the Appendix A for a full list of supported Microsoft applications.

There are also some ‘generic’ applications, ‘TLS’ and ‘TLS.Microsoft’ which don’t appear to point to a specific Microsoft applications yet clearly use a Microsoft TLS certificate. By selecting them and applying a filter, we can drill down further into these applications to further identify and classify. More detail of how to identify specific applications that are classified with a generic TLS or TLS.Microsoft label is provided in the following section.

Destination Host/Server Based Inspection

The Microsoft application landscape is large and dynamic. New applications frequently emerge and with the advent of cloud computing via Azure, there is an increasingly large number of available applications. To make Microsoft application even more complicated, many Microsoft applications are organisation specific. For example Microsoft Sharepoint uses an organisational specific URL such as byte25.sharepoint.com.

Byte25 classifies these applications under a generic Microsoft.TLS label, however, further detail as to the specific application and associated users is still available from the Top 30 TLS Destinations (HTTPS server) under Application Summary tab. 

Figure 3. Sample Microsoft Specific URLs

This allows us to clearly see, and filter on, individual custom Microsoft applications such as Sharepoint and other Microsoft specific applications. Again, note that this screenshot is an example from our office, the range of Microsoft applications will vary depending on the specific mix of Microsoft services run in your environment.

Appendix A. Supported Microsoft Applications

[1] TLS and HTTPS are related but not the same. TLS is a protocol for encrypting data, while HTTPS is a protocol for transferring data over the Internet

[2] As a result of the Microsoft acquisition of Skype, Teams uses the Skype protocol for audio and video calls. Byet25 classify and label Teams traffic as ‘Skype’.  Note that it still uses a Microsoft certificate so is visible when we filter on Microsoft traffic.