This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I don't want to know anything about what they visited while vpn was active or anything i just want to know if anyone uses a vpn on my network.

asked 05 Jul '17, 19:02

Someone%20who%20needs%20help's gravatar image

Someone who ...
6112
accept rate: 0%


First, let's assume you can capture at the router which connects everyone in your network to the internet. Capturing on wireless networks is another can of worms so better to avoid it if you can.

Second, I suppose you have in mind those VPNs which are used to obfuscate what the user is doing on the internet from the network administrator and to anonymize the user to the services he visits, not the VPNs which are used to connect remote users to company networks.

If so, a typical pattern would be that a local machine has one or several encrypted conversations with a single remote IP while almost no other traffic towards the internet exists from that machine. You cannot 100% rely on spotting well-known ports used by VPNs for remote access because some VPN sites may mask the traffic as https or imap over tls while others may use e.g. OpenVPN which normally uses UDP as transport for the encrypted data. Even the traffic flow may be artificially modified (by transmitting bogus data while no real data flow is necessary). And there are many other things which can be done to make VPN traffic look similar to a normal one, including establishing transport conversations with many IPs at different times and spreading the actual conversations among them. So you'll never be certain. That's the goal after all.

permanent link

answered 05 Jul '17, 23:42

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×45
×1

question asked: 05 Jul '17, 19:02

question was seen: 1,799 times

last updated: 05 Jul '17, 23:42

p​o​w​e​r​e​d by O​S​Q​A