---
title: "Don’t Talk To Strangers (DTTS): A Technical Deep Dive Video"
description: "A School of Cyber deep dive into DTTS, which resets any connection that is not already established and does not follow an allowed DNS lookup."
url: https://adamnet.works/videos/dont-talk-to-strangers-dtts-technical-deep-dive/
index: https://adamnet.works/llms.txt
---

[All videos](https://adamnet.works/videos.md)

DTTS · Technical Overview · Zero Trust Connectivity

# Don’t Talk To Strangers (DTTS)®: Technical Deep Dive

An ADAMnetworks School of Cyber technical description of Don’t Talk To Strangers (DTTS), which lets a connection through only when it is already established or follows a policy-allowed DNS answer.

June 13, 2023 • 16 min

![Don’t Talk To Strangers (DTTS) technical deep dive](https://adamnet.works/assets/thumbs/yt-UpLWuEQI50Y.webp)

This ADAMnetworks School of Cyber session demonstrates Don’t Talk To Strangers (DTTS)®, which the presenter describes as “a security design flaw fix in TCP/IP.”

A stranger is an IP address that was never resolved through a permitted DNS query. The demonstrations show proxy servers, Tor, DNS over HTTPS, C2 beacons, Telegram, retail VPNs and Psiphon failing when they try to connect straight to an IP address. DTTS lets a packet through only when it belongs to an already established connection or follows an allowed DNS answer within its time to live. Configured enablers can also allow named domains or IP ranges by protocol and port. Everything else gets a reset packet.

For the full technology stack, read the [ADAMnetworks Technical Brief](https://adamnet.works/papers/adam-one-technical-brief.md). For managing the applications that need exceptions, see [DTTS Policy Violation Management](https://adamnet.works/blog/dtts-policy-violation-management.md).

## Full Transcript

**David Redekop:** Hey guys, let’s get technical about Don’t Talk To Strangers. We think of it as a security design flaw fix in TCP/IP, and I’d like to just show you some real-life examples and then cover off in more detail exactly how it works. Let’s jump to my screen here.

### A stranger in action

**David Redekop:** Okay, so I am at my trusty terminal window here, and I’m going to choose to ping an IP address here, strategically, at 142.251.32.78. This IP address is owned by Google, but to this system and this policy that this device is on, that IP address is currently a stranger, because it was never looked up by DNS to begin with. But if my policy allows me to resolve google.com, I am able to resolve to that IP address that I was unable to ping a moment ago. Now if I were to ping it again, I am able to ping it just fine. It is no longer a stranger, and it is no longer a stranger for the period of the time to live. And so this is basically Don’t Talk To Strangers in action.

**David Redekop:** I can further examine this by doing any other IP protocol. By, say, let’s take a look if we can pull up the website of that same IP address. And so I would look at that IP address over curl, and it is able to pull it down just fine, whereas it could not do that as long as it was a stranger. So there you go, that’s how simple Don’t Talk To Strangers works in action.

### Proxy servers

**David Redekop:** But let’s now look at some real-life applications that we see daily where this works in ways that have very real-life consequences. So the first example I would like to show you is how a proxy server connection might be used by malware to circumvent policy, and in an attempt to exfiltrate or circumvent. So I’ve gone to look at some free proxy servers, and I found one here. It looks like this one in Germany, it’s got a very 100% uptime, low latency. Let’s give that one a try. I’m gonna copy that IP address over here in my Firefox. I’m going to choose a manual proxy setting with that port and then select OK.

**David Redekop:** Now what I want to do is open up a new tab, and let’s see if I can go to Google. No, I can’t. The proxy server is refusing connections. Well, why would that be? If I take a look at my traffic log, which is what’s showing in live mode here, I’m going to say show me everything going to port 8080, and we’re seeing the many attempts per second that this computer is attempting to make to that IP address at 8080 and unable to do so. That’s another example of Don’t Talk To Strangers in action.

### Tor

**David Redekop:** Let me jump to one other example. Back to my Brave browser, I’m going to choose a new private window with Tor. Now, as we’re opening up this new private window with Tor, you see that it’s connecting to a relay, or attempting to connect to a relay, and it’s going to sit here for a while. In the meantime, let’s take a look at our traffic log to see what is being attempted as it’s trying to do so. And you’ll see that there is some legitimate traffic from my Mac mini that’s going through just fine, but not anything that is attempting to go to a Tor relay. And we have an easier way to even identify it, by simply saying let’s limit it to destination port 9100, because that’s the most common one, but it could also be any other port that it may be using.

**David Redekop:** If we look back at my Brave browser window trying to open up this Tor network, it will sit here for some time and eventually will give up. So I’ll just fast-forward this part of the video so you can see that it takes some time. So there you go, the Tor connection failed, and it will always fail with Don’t Talk To Strangers, because every exit node it attempts to connect to is by IP address, which all happen to be strangers. And of course malware uses Tor on a regular basis.

### DoH and C2 beacons

**David Redekop:** Next I want to show you what happens. Let’s jump back to my terminal window. What happens if we try to make a DoH query? Now, DoH is a very powerful technology that secures our DNS, but it also facilitates command-and-control operations. If we do a simple search on GitHub, for example, for “DoH C2,” we’ll find many projects that facilitate this. So the idea is to prevent those DoH connections from happening. So if I were to now try to curl over to simulate making a DoH connection to Cloudflare, I should not be able to make this query. And there you go, I cannot. We get an immediate connection refused after attempting to make a DoH query. Now, that is exactly the behavior that we want, right?

**David Redekop:** But here’s another example. What about a Cobalt Strike kind of beacon, or a Sliver beacon? Let’s say that malware has successfully landed on a network by an attachment that shouldn’t have been opened, or a PowerShell script that was run and pulled down an implant. In that case, we don’t want it to be able to make that connection, right? So that the command-and-control channel is never established to begin with. So let me show you how that would work. So back to my terminal window here, I could choose any IP address anywhere on the internet. So I have no idea what might be here. Let’s just choose something, 1.2.3.4.5, it doesn’t matter what there is. Any IP address will simply get a connection refused, because they are all strangers. So there you go, even those beacons did not connect.

**David Redekop:** In our experience, malware authors almost always use IP addresses only, because if they were to use domain names in their attempt to make a C2 connection, they would be leaving too much information behind for security analysts to sweep up. And so this is one of the very effective ways that these C2 connections simply fail.

### Telegram

**David Redekop:** Now I want to switch to some apps. What about Telegram? Telegram is a powerful C2 channel as well. In fact, it took Russia shutting down half the internet in order to shut down Telegram some years ago, when they no longer wanted to facilitate it. But let me show you how Don’t Talk To Strangers does it.

**David Redekop:** Okay, so I have Telegram, the app, running both on my desktop here as well as on this iPad here. And so before I started the video, I successfully exchanged some messages back and forth. And now that I have Don’t Talk To Strangers running, if I say hello again, it will stay in an attempt to continue to try and make a connection, but is unable to do so. And the same thing happens from the iPad coming back: I cannot send any messages. You’ll see even at the top of the application that it continues to say “Connecting…”

**David Redekop:** And again, if we take a look at our traffic log, what we will see here is the continuous attempt of this device here trying to make connections to, let me just filter this reasonably, so we have just my Mac at this IP address continuously trying to make connections over to Telegram IP space. So this would be the 149.154 address range, and you’ll see TCP at various ports that it’s attempting to communicate to. It will never succeed, because Telegram uses IP fronting and does not use DNS names in order to make a connection to their back end. So there you go, Telegram is completely disabled from making any command-and-control connections, any exfiltration attempts, just by utilizing Don’t Talk To Strangers. Again, because all of the destinations it attempts to connect to, whether they are Telegram IPs or their IP fronting, domain fronting networks around the world, they’re simply all strangers.

### Retail VPNs

**David Redekop:** But what about applications like a VPN, a retail VPN, for example? Let’s jump back to my screen here. So I have a Windows virtual machine here that I will connect us to, and in it I have ExpressVPN, one of the world’s largest VPN providers. But one of the things that most VPN providers do is they either have a set domain that gets used for connections, or they don’t use domains at all and just use IP addresses. So in this case I’m going to connect to a default location, which happens to be the nearest, in Toronto. And then I’m going to look at the domain logs right away of what happens, how it attempts to connect. And you’ll see that in the domain log we don’t really see anything out of Windows’s ordinary connection attempts.

**David Redekop:** But if we navigate over to my traffic log, we are now going to see that this particular computer is making a variety of connections: different IP addresses, different ports, different protocols. At first it’ll try UDP; when it fails, it’ll try TCP, as we can see right here. Bottom line is it will continue to rotate through a variety of IP addresses, simply unable to connect, because all of these destinations are strangers. I’m going to stop this connection because it won’t succeed anyway.

### Psiphon

**David Redekop:** And let’s switch over to another one, which is Psiphon. Psiphon is a very powerful tool for a libertarian that finds himself in a place that is unable to connect to the broader web. But let’s use it as a way where we simulate what malware could do by being extremely persistent with trying all kinds of different ways. And right away in the domain log, we’re seeing that we’re even getting invalid DNS packets. Let me just pause the log here for a second so we can talk about this one.

**David Redekop:** Invalid DNS packets means that this application was attempting to use port 53, not as a DNS tunneling method, but by utilizing a port that in many networks happens to be open, because we need port 53 for DNS services. So a simple careless mistake on a network would allow this kind of port 53 traffic through. But again, because it’s trying to do it via an invalid DNS connection, it is simply not allowed through.

**David Redekop:** And if we take a look back at our traffic log, we’re seeing how persistent and pervasive it is in trying to make connections via all kinds of ports. Legitimate traffic will show up in green, that’s allowed through, but all of these red connections are attempts to connect over port 443, which is very commonly open, and in many cases, even in a firewall proxy, is not inspected. And so tools like this can hide in plain sight by utilizing open ports, or at the very least attempt to make a connection. Bottom line is all of these destinations that it’s attempting to connect to at various ports and protocols are all strangers, and therefore there’s nothing to worry about. A new subscriber that might be showing up, or a new IP address, might even be attempted. We see, for example, in the Psiphon app here, it says, “Oh no, you seem to be having trouble connecting.” And at that moment it actually ended up going to Amazon S3 and pulled down a new list of sponsors to make a connection, and is still unable to do so.

**David Redekop:** Just one more comment about Psiphon. We appreciate Citizen Lab very much in their role in helping freedom fighters and libertarians around the world, but it also happens to be a wonderful tool to test our defenses, to test your defenses. And so here’s your opportunity: instead of planting real malware to test that out, use a good, clean tool and see how good your defenses are.

### How DTTS decides

**David Redekop:** Quite simply, this process here is followed for every single packet that’s attempting to leave a host that heads outbound to another network, which is usually the internet. So for example, if a packet here is attempting to go out via an already established connection, it is not a stranger. Similarly, if a packet is not yet in an established connection, but a prior DNS query was successfully made because it was allowed, and it’s still within the time to live, it also makes it out and is not treated as a stranger. But if it is neither established traffic, nor a DNS query was made or allowed, in that case a reset packet is sent back to the connection, which then dies a very quick death, allowing the application to immediately start over again or shut down at that point.

**David Redekop:** Either way, Don’t Talk To Strangers works with the compatibility element, with enablers, as we call them, which allows a specification for fully qualified domain names or IP ranges, with protocol and port destinations or sources, to be allowed, to make such apps still be fully functional. So there you go. That is the fix to the security design flaw that is part of TCP, and any secure access service edge that uses DNS as part of its protection system. Thanks for watching.

[Watch on YouTube](https://www.youtube.com/watch?v=UpLWuEQI50Y)

## Related reading

Articles

### [Microsoft ZTDNS vs ADAMnetworks Zero Trust Connectivity (ZTc)](https://adamnet.works/blog/microsoft-ztdns-vs-zero-trust-connectivity.md)

May 13, 2024

Articles

### [DTTS | Zero Trust DNS Enforcement: Policy Violation Management](https://adamnet.works/blog/dtts-policy-violation-management.md)

October 23, 2025

Video

### [The Solarigate (SUNBURST) Killer](https://adamnet.works/videos/solarigate-sunburst-killer.md)

January 6, 2021

## See it on your own network

Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us about what that looks like in your environment.

[Request a Demo](https://adamnet.works/contact.md) [How adam:ONE® Works](https://adamnet.works/how-it-works.md)