This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to clearly verify that program work through a VPN ?

0

Hi,

I want to see that a program work nicely with a VPN. The programm will pass totaly on a different IP, but I don't know how check it with WireShark.

Thanks.

asked 05 Jun '14, 16:59

vincreu's gravatar image

vincreu
11113
accept rate: 0%

Please add more details about your vpn setup, the application/program and what kind of 'proof' you expect to get with Wireshark.

(05 Jun '14, 21:32) Kurt Knochner ♦

Hi,

the VPN is "privatetunnel".com . I am in Belgium and in connect in Canada with the VPN. The program is a poker room. I pLay poker in Russia with the VPN.

The site "privatetunnel" says to me that I can verify that the poker room connect in a russia's IP with WireShark.

He says :

Generally speaking, you can capture on the TAP-32 adapter that is created and analyze the traffic flow on the adapter for signs that your connection is tunneled properly.

And don't know how to do.

Thanks.

(06 Jun '14, 06:03) vincreu

Help

(07 Jun '14, 16:43) vincreu

"Generally speaking, you can capture on the TAP-32 adapter that is created and analyze the traffic flow on the adapter for signs that your connection is tunneled properly.

And don't know how to do." Do what?

So is the TAP-32 adapter created and you cannot trace it? Or could you trace it but cannot interpret the capture file?

(08 Jun '14, 02:19) mrEEde

So how can I verify if all the program pass through the VPN ?

Thanks.

(09 Jun '14, 06:46) vincreu

One Answer:

1

but I don't know how check it with WireShark.

You don't need Wireshark for that. I'm not even sure if WinPcap would show traffic for that the 'TAP-32' VPN adapter.

So how can I verify if all the program pass through the VPN ?

Check the routes on your client in a DoS box:

route print

If the default route (0.0.0.0) 'points' to the VPN adapter, the whole internet traffic is directed into the VPN.

that I can verify that the poker room connect in a russia's IP

Just surf to the following site, while you are connected to the VPN and check if the IP address that is shown, belongs to an ISP from Russia.

http://www.whatismyip.com/

Regards
Kurt

answered 09 Jun '14, 10:21

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

I write "route print" in cmd, then I see on the "list of interface" :

19...xx xx xx xx xx xx...Tap adapter V9 for private tunnel

8...yy yy yy yy yy yy...Microsoft wi-fi direct virtual adapter

(...)

Is it a proof that all the program, not only the internet-navigator, work on the russian ip throught the VPN ?

Thanks.

(17 Jun '14, 13:31) vincreu

No! The existence of the VPN adapter is no proof at all. It's important that the route 0.0.0.0 (or similar routes) 'use' that adapter. Can you please post the output of the following command, if you are unable to determine that yourself?

route print

(17 Jun '14, 14:50) Kurt Knochner ♦

VPN Private Tunnel connect from belgium to Switzerland 'Zurick'.

I hide many of the information that seems secrete. If it's usefull to give it, just tell me ^^. Thanks

alt text

(18 Jun '14, 07:03) vincreu

If I access the URL you posted

http://imagizer.imageshack.us/a/img819/1334/pzmt.png

I get nothing but: STATUS_403

(18 Jun '14, 09:47) Kurt Knochner ♦

alt text

(18 Jun '14, 10:16) vincreu

as you can see, there are two network routes to the VPN adapter:

0.0.0.0/128.0.0.0 ==> 5.5.0.1
128.0.0.0/128.0.0.0 ==> 5.5.0.1

As the network routes have precedence over the default route (0.0.0.0/0.0.0.0), the whole traffic is routed into the VPN tunnel.

So, the answer to your question is: Yes, everything is routed into the VPN (as expected).

Regards
Kurt

(18 Jun '14, 14:23) Kurt Knochner ♦

Ok thanks you very much that help me !

Thx.

(18 Jun '14, 16:36) vincreu

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).

(19 Jun '14, 01:24) Kurt Knochner ♦
showing 5 of 8 show 3 more comments