As part of my thesis I also analysed the Skype application.

In one case I discovered unusual traffic that doesn't appear in any other connection I tested.

Traffic between clients

Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes pps bps Bpp

982.074 UDP 94.112.65.239:9235 -> 192.168.1.203:48290 56267 17.7 M 57 144176 314  
982.074 UDP 192.168.1.203:48290 -> 94.112.65.239:9235 49730 10.0 M 50 81411 200

Traffic between the client and Skype-owned servers

Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes pps bps Bpp

840.179 UDP 149.5.45.19:8192 -> 192.168.1.203:48290 1236 62128 1 591 50  
840.179 UDP 192.168.1.203:48290 -> 149.5.45.19:8192 717 37338 0 355 52  
820.854 UDP 192.168.1.203:48290 -> 149.5.45.19:8193 15831 20.5 M 19 199847 1295  
836.558 UDP 192.168.1.203:48290 -> 149.5.45.15:8192 500 23916 0 228 47  
836.558 UDP 149.5.45.15:8192 -> 192.168.1.203:48290 29623 36.9 M 35 352593 1244  
820.327 UDP 192.168.1.203:48290 -> 149.5.45.15:8193 1027 51080 1 498 49  
561.993 UDP 192.168.1.203:48290 -> 149.5.45.43:8192 143 7037 0 100 49  
561.993 UDP 149.5.45.43:8192 -> 192.168.1.203:48290 196 10111 0 143 51  
43.861 UDP 192.168.1.203:48290 -> 149.5.45.43:8193 1281 1.7 M 29 302021 1292

What's striking about this is several things. Data volume — During the call I sent the other party about 10 MB and received 17.7 MB; the flow characteristics match a stream. But the data my client sent out into the world was even larger! (22.2 MB). From the volume characteristics it's clear this is a download/upload.

*Network prefix — All the traffic I observed can be attributed via whois to Microsoft Corporation and its prefixes. However, this particular prefix (149.5.45.0/24) belongs to Skype itself (headquartered in Luxembourg), and the specific servers are located in Washington D.C. (based on IP geolocation).

I'm still trying to work out what the purpose is — why did I never see this behaviour before or after? I was always communicating directly with the other party, so the explanation that data would go via a Skype server to reach them doesn't hold up. The volume of data being uploaded/downloaded to Skype's servers is also striking (it's not an update — that works differently on Linux). Only one conclusion remains — did I just uncover PRISM?!**