Forgive me if this is not the appropriate place to ask this.
I was capturing some traffic on my home server during an active OpenVPN session using Mullvad recently and I noticed that the traffic is predominantly UDP which would make sense per the .conf file:
client dev tun proto udp
However I noticed that there was some traffic using TCP and TLSv1.2 to an IP address that I do not recognize.
Here is a screenshot of the partial capture showing the TCP traffic:
Here is a screenshot of the partial capture without the TCP filter:
However the strange part to me was that I was seeing this same traffic (ie. TCP and TLSv1.2) to the same address after I had closed the OpenVPN service.
Here is a screenshot of the 'unencrypted' traffic:
I'm sure that there is some fundamental idea here that I am simply missing... If I need to do more research I would love a shove in the right direction.
Also, for what it is worth I did have at least a couple of other services running during these captures, namely Transmission, Plex, and obviously SSH.