# To what extent can P4 extract attributes/headers/etc from HTTPS packets **URL:** \ **Category:** P4 Dev\ **Created:** [November 27, 2023, 2:42pm UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042 "2023-11-27T14:42:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bcheevers123](https://avatars.discourse-cdn.com/v4/letter/b/f1d935/32.png) [@bcheevers123](https://forum.p4.org/u/bcheevers123)\ **Post date:** [November 27, 2023, 2:42pm UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/1 "2023-11-27T14:42:55Z")
To what extent can P4 extract attributes/headers/etc from HTTPS packets? I understand that P4 can extract information from protocols at Layer’s 4 and below: `header ethernet\_t { bit\<48\> dstAddr; bit\<48\> srcAddr; bit\<16\> etherType; } header ipv4\_t { bit\<4\> version; bit\<4\> ihl; bit\<8\> diffserv; bit\<16\> totalLen; bit\<16\> identification; bit\<3\> flags; bit\<13\> fragOffset; bit\<8\> ttl; bit\<8\> protocol; bit\<16\> hdrChecksum; bit\<32\> srcAddr; bit\<32\> dstAddr; } header tcp\_t{ bit\<16\> srcPort; bit\<16\> dstPort; bit\<32\> seqNo; bit\<32\> ackNo; bit\<4\> dataOffset; bit\<3\> res; bit\<9\> tcp\_flags; bit\<16\> window; bit\<16\> checksum; bit\<16\> urgentPtr; } header udp\_t { bit\<16\> srcPort; bit\<16\> dstPort; bit\<16\> udplen; bit\<16\> udpchk; } header icmp\_t { bit\<8\> type; bit\<8\> code; bit\<16\> checksum; } struct headers { ethernet\_t ethernet; ipv4\_t ipv4; tcp\_t tcp; udp\_t udp; icmp\_t icmp; } ` But how would one go about extracting Layer 6 protocol information, such as HTTPS? Are their examples of this? ---
**Author:** ![andyfingerhut](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.p4.org/andyfingerhut/32/17_2.png) [@andyfingerhut](https://forum.p4.org/u/andyfingerhut)\ **Post date:** [November 27, 2023, 6:12pm UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/2 "2023-11-27T18:12:52Z")
To the extent that packets are encrypted, and your P4-programmable device does not have the decryption keys available, any part of the packet that is encrypted is effectively random gibberish to your P4 program. I believe that for HTTPS, what you can see not-encrypted in packets are Ethernet + IPv4/IPv6 + TCP headers, and everything after the TCP header is encrypted, but I have not recently reviewed HTTPS to verify that. ---
**Author:** ![bcheevers123](https://avatars.discourse-cdn.com/v4/letter/b/f1d935/32.png) [@bcheevers123](https://forum.p4.org/u/bcheevers123)\ **Post date:** [November 28, 2023, 8:17am UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/3 "2023-11-28T08:17:57Z")
Yes, I am aware that one would not be able to actually see the content of the HTTPS (as it is encrypted) but could one obtain packet features such as “Content-Length” from the header etc? ---
**Author:** ![andyfingerhut](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.p4.org/andyfingerhut/32/17_2.png) [@andyfingerhut](https://forum.p4.org/u/andyfingerhut)\ **Post date:** [November 28, 2023, 8:40am UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/4 "2023-11-28T08:40:39Z")
If by “Content-Length” you mean a field value defined by HTTP, then I am fairly sure that and every other HTTP field and value are part of the TCP payload data, and encrypted when you use HTTPS. ---
**Author:** ![bcheevers123](https://avatars.discourse-cdn.com/v4/letter/b/f1d935/32.png) [@bcheevers123](https://forum.p4.org/u/bcheevers123)\ **Post date:** [December 3, 2023, 10:14am UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/5 "2023-12-03T10:14:36Z")
Ah yes you are correct, however I would be able to access the TLS packet information: header tls\_handshake\_t { bit\<8\> handshake\_type; bit\<24\> length; } ---
**Author:** ![p4prof](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.p4.org/p4prof/32/251_2.png) [@p4prof](https://forum.p4.org/u/p4prof)\ **Post date:** [December 10, 2023, 2:06am UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/6 "2023-12-10T02:06:25Z")
@bcheevers123 , In addition to the excellent responses provided by @andyfingerhut , I think I should point out an often overlooked fact and that is that the TCP is a **streaming** protocol, meaning that packet boundaries are largely irrelevant there. An individual message can be split into any number of packets (at the extreme ed it can be 1 byte per packet), it does not need to start on the packet boundary (until you are looking at the very first byte of the stream), etc. Usually, properly matching on anything inside a TCP stream (even an unencrypted one) requires you to (a) reassemble the stream and (b) use regular expression matching. Both (a) and (b) are pretty difficult to implement in P4 unless the target provides a lot of specialized support for this functionality. Happy hacking, Vladimir ---
**Author:** ![bcheevers123](https://avatars.discourse-cdn.com/v4/letter/b/f1d935/32.png) [@bcheevers123](https://forum.p4.org/u/bcheevers123)\ **Post date:** [December 10, 2023, 10:32am UTC](https://forum.p4.org/t/to-what-extent-can-p4-extract-attributes-headers-etc-from-https-packets/1042/7 "2023-12-10T10:32:09Z")
Thank you @p4prof for your insight here. Yes, since TCP is a streaming protocol, I’ve written a python script that interfaces with P4 and attributes each packet to the corresponding flow/stream. I suppose my main query was what fields could one extract from an HTTPS packet or TLS packet provided that one doesn’t know the decryption key. Things such as; number of bytes, size, content length etc. Has anyone created a header(s) for this?