I have a mobile data plan of 2 GBs. When I exceed it, I always get redirected to the network operator's website when I trying to load an URL. For some reason Telegram(Android app only, Desktop app doesn't go through) works without any problem or restriction. I can send and receive texts, audio messages and pictures.

My question is how does Telegam (or a similar app) goes through the block.

When inspecting Chrome Dev. console's network tab every website throws an HTTP 302 Moved Temporarily status code, and I get redirected to the network OP's site. I verified that Telegram works on HTTP 1.1/TCP port 80.

Additionally, is it a bug in network op's software? Is it legal to use although my data plan is exceeded? I'm curious.

The browsing and traffic of other apps are totally blocked, so it's not about that my data plan just got slowed down. And in my country there is no law for enabling some data traffic for emergency text, at least not over data plan. Also my network operator hasn't advertised free network traffic for Telegram, like other network operators for facebook or etc..

I tried reviewing my network traffic with Wireshark but there was no main difference in the packets of Telegram and Chrome's packets. I also started to search after some connection techniques in Telegram's code(it's on github) but it has a really huge code base.

I also noticed this behavior with Skype last year, but now it doesn't seem to connect.

  • 4
    I'm voting to close this question as off-topic because it is about network management, not reverse engineering. – Guntram Blohm supports Monica Aug 20 '16 at 21:07

One of the ways to block unauthorized internet access in similar kiosks is by implementing a DNS redirection. Responding to any DNS request with the same server, and having that server redirect you to the "exceeded data plan" with 302 Moved Temporarily HTTP response.

This can be validated by accessing an IP directly instead of a domain name, and might be what Telegram is doing.

Another method often used could be directly spoofing the HTTP response with a 302 Moved Temporarily response. This usually works when accessing websites using the http:// protocol. While most websites will redirect you to the https:// URL the connection starts unencrypted and that's a nice opening to hijack it. Telegram might be doing it for security reasons.

This can be validated by accessing the https:// URL of any website.

The third option is communicating at a level lower than HTTP, thus bypassing the redirection completely. Telegram may be using something more raw as a backup option for when HTTP fails when communicating with its servers, or may use some kind of peer-to-peer communication to use other users as proxies when internet is not directly available.

I can't think of a simple way to validate that idea.

Not the answer you're looking for? Browse other questions tagged or ask your own question.