ECH traffic classification for TLS 1.3

F5 BIG-IP Next Cloud-Native Network Function (CNF) traffic classification engine classifies the (TLS) 1.3 traffic that has the Encrypted Client Hello (ECH) extension. This feature gives service providers better visibility about the ECH traffic and the ability to apply policies such as rate-limiting or blocking.

How ECH classification works

When traffic classification engine detects the ECH extension in a Client Hello packet, it classifies the traffic using a naming format that reflects the protocol and application:

Protocol	Classification format
TCP (SSL)	tcp.ssl.ech.<application_name>
UDP (QUIC)	udp.quic.ech.<application_name>

Note

If signature for a visible SNI is unavailable, Deep packet inspection (DPI) classifies the traffic with ECH extension as tcp.ssl.ech or udp.quic.ech.

For example, if a client hello packet has ECH extension and the outer SNI is cloudflare-ech.com, and the cloudflare-ech signature is available, the classification engine identifies and classifies the traffic as tcp.ssl.ech.cloudflare-ech. Otherwise, the DPI classifies the application as tcp.ssl.ech.

The Ech_Category

Traffic classification engine introduces an Ech_Category category at the protocol level. This category provides broad visibility into all traffic that uses TLS 1.3 with ECH, regardless of the specific application.

You can apply policies to the Ech_Category category to manage the traffic at scale. For example, you can block all ECH traffic as a group.

Verify ECH traffic classification

Verify the classification engine correctly classifies the ECH traffic.

1. Generate or send TLS 1.3 traffic with the ECH extension to your BIG-IP Next CNF instance.

2. Check the classification results on the gpa_dpi_stats table:

   /tmctl -d blade gpa_dpi_stats -w150
   

   Sample output:

   /tmctl -d blade gpa_dpi_stats -w150
   result                         count dpi flbl srdb custom bytes_in bytes_out pkts_in pkts_out
   ------------------------------ ----- --- ---- ---- ------ -------- --------- ------- --------
   tcp.ssl.ech.cloudflare-ech         3   3    0    0      0     8004       336       9        6
   tcp.ssl.ech.youtube                3   3    0    0      0   111408       960      22       18
   tcp.ssl.ech.youtube.ytimg          3   3    0    0      0     5877       336       9        6
   tcp.ssl.ech.google                 6   6    0    0      0    14268       672      18       12
   

Apply policies to ECH traffic

After classification is working, you can apply policies to the application or category level. For example, you can block or allow all ECH-classified traffic.