Can you sniff VPN traffic just like you would a coffee shop?

Question

I see a few questions related but am not sure I understand how VPNs work so my question is: Can you sniff VPN traffic the same way as you would another network like a coffee shop. For example, at a coffee shop, I can just run tcpdump and listen to any connections to that coffee shops router thus seeing what the person next to me is doing. However, does a VPN work like this as well? For instance, could I setup a VPN and the user next to me is on the same VPN (different user login to the VPN) and run tcpdump and still sniff that persons traffic?

I understand that VPN traffic is encrypted but that is to people outside of the VPN itself (or is it also encrypted for each user?).

Answer 1

It really depends on which VPN protocol is used and how the server is setup, but in general it's not possible for people on the same VPN network to sniff all traffic from others.

You can do this on WiFi only because the airwaves is a shared medium and the protocol does not enforce peer to peer keys.

VPN uses peer-to-peer tunnels between the client and the server and normally with per session keys, so it's actually equivalent to a switched wired network in terms of privacy and you cannot easily listen to other people's traffic.

However, the same tricks that works on wired networks like ARP spoofing may still be effective on certain L2 VPNs and weakness in the protocol/implementation may allow the session key to be extracted by people who know the credentials used.

Answer 2

VPNs are encrypted per User. What tcpdump will tell you in a Public WiFi is that there are people using VPNs. But thats all - everything else is encrypted and - assuming the VPN vendor implemented the crypto correctly - cannot be sniffed on the user-side.

However: If you know the VPN users exit node you could sniff packages travelling in the exit nodes network. You would then have to corelate these packages with the encrypted ones you see the user sending/receiving. Inpractice, this is very cumbersome due to the vast amount of internet traffic but was effectively used by the FBI to pwn tor users. That means: Using a VPN and not using HTTPS/TLS creates an attack surface big enough for a determined attacker to render your VPN useless.

Answer 3

yes you can sniff the traffic if everyone is in the same broadcast domain but you won't be able to read it. sending continuous ARP replies to both gateway and victim workstation will position you in the middle i.e. MITM.

maybe the VPN is split tunnelling !! so just maybe you could read the traffic.