0
  • I use Wireshark to sniff return traffic on my machine

However, it only gives me the IP address of my VPN.

How do I sniff out the traffic after it has been decrypted on my machine?

My filter is something like:

ip.src == 192.168.1.x
udp.port == xxxx
data.length = x.

I am using OpenVPN and need the returned decrypted information.

Any ideas about what's going on?

18
  • Short answer: You can't. Decrypted data is not transmitted anywhere on the network. It is decrypted after being received so wireshark doesn't pick it up. VPN <---> Wireshark <---> You. Both links are encryped. You cannot see it. Jun 3, 2016 at 21:02
  • Ok so there is no way to do it without leaking my own IP by sudo killall openvpn I can get what i want then but that leaks my IP which must be a no no
    – smokingjak
    Jun 3, 2016 at 21:56
  • There must be an output from openvpn that can be monitored locally surely
    – smokingjak
    Jun 3, 2016 at 21:58
  • @smokingjay Why would privacy software keep logs? Jun 3, 2016 at 22:08
  • They dont but killing vpn to get my info will leak my real IP so i need the info without disconnecting
    – smokingjak
    Jun 3, 2016 at 23:14

1 Answer 1

0

Short answer: You can't.

At no point is unencrypted data transmitted on your network interfaces.

What you are asking is exactly what VPNs are designed to protect you from.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .