Author Topic: Could someone help me out, is my connection secure (wireshark)  (Read 1231 times)

0 Members and 1 Guest are viewing this topic.

Offline Demonfin

  • NULL
  • Posts: 1
  • Cookies: 0
    • View Profile
Hello
 
 I bought this vpn package for my self to get some privacy. After using it for awhile i thought i should check if it really is secure. I did some research and downloaded Wireshark. I also tested my DNS leakage, and got no leaks through test. Only two ips and both are public dns services like it should be.
 
 I started the program and there was 2 network adapters.
 
 - my normal ethernet card.
 - Virtual card setup by vpn.
 
 Now when i use the wireshark on my virtual card the traffic is encrypted or it looks like it, but i can still see what websites i visit like google.com and yahoo.com etc.. I got worried that maybe my isp sees this information too. I would like to be 100% anonymous to my country of origin, includeing my isp.
 
 BUT if i use wireshark on my normal ethernet adapter i can ONLY see traffic on UDP ARP NBNS, i think those are all and no website header info, only 3 ip addresses that are connected to the vpn i think.
 
 So can my isp see where i visit, if my ethernet adapter does not show desination or source, only vpn ips or can my isp see the information on the vpn setup virtual adapter?
 
 I'm newbie in this stuff so would like to get more educated answer heh heh.
 
 Also any other way of testing things out?
 
 Thanks alot for reading.
 
 Demonfin
 

This is what the packages show if i inspect them:
 
 0000  00 25 86 e3 85 a8 f4 6d  04 0e 8d 16 08 00 45 00   .%.....m ......E.
 0010  00 69 63 a6 00 00 80 11  00 00 0a 3c cf ad 1f 07   .ic..... ...<....
 0020  39 c6 e2 19 1f 90 00 55  33 1d 35 e9 41 08 4a 4b   9......U 3.5.A.JK
 0030  cc e7 f7 eb 33 c7 7f 22  52 83 f2 0f d1 fe fc 2d   ....3.." R......-
 0040  98 3b a3 b6 09 84 be 9e  93 d6 68 c9 81 e0 28 d3   .;...... ..h...(.
 
 Is that encrypted?

Offline RedBullAddicted

  • Moderator
  • Sir
  • *
  • Posts: 519
  • Cookies: 189
    • View Profile
Re: Could someone help me out, is my connection secure (wireshark)
« Reply #1 on: January 04, 2013, 08:35:56 am »
Hi Daemonfin,

first of all you should write a short introduction into our members introduction board. Its not very nice to ask for help without telling us who you are and what your intentions are. Look through other introduction posts first to avoid repeating mistakes others already did.

second a little advice: the more information you provide the better the answers you will get :)

What kind of VPN are you using? IPSec, SSL, PPTP ... ?
You need to think about your capturing setup. Where does wireshark capture and where does the encryption happen? I would always recommend capturing on the way from your machine to the router and not on the machine directly. Do you know how the different VPNs work? IPSec for example (this is a very basic discription) sends your request as an completely encrypted udp packet. If you are behind a NAT device (and you are) IPSec would not be working cause the NAT device is not able to look into the packet to manipulate the header information. IPSec uses a TCP NAT traversal to make it usable behind NAT devies. Your encrypted udp packet gets encapsulated in a tcp packet with an unencrypted header. Source and destination is not encrypted when this is happening.

Your packet is a normal hexadecimal representation. To see if it is encrypted I would need to resend that packet and capture it again. I am to lazy to do it and for this I can't tell if it is encrypted.

Hope this helps!

Cheers,
RBA

Deep into that darkness peering, long I stood there, wondering, fearing, doubting, dreaming dreams no mortal ever dared to dream before. - Edgar Allan Poe