0

Forgive me if this is not the appropriate place to ask this.

I was capturing some traffic on my home server during an active OpenVPN session using Mullvad recently and I noticed that the traffic is predominantly UDP which would make sense per the .conf file:

client
dev tun
proto udp

However I noticed that there was some traffic using TCP and TLSv1.2 to an IP address that I do not recognize.

Here is a screenshot of the partial capture showing the TCP traffic:

enter image description here

Here is a screenshot of the partial capture without the TCP filter:

enter image description here

However the strange part to me was that I was seeing this same traffic (ie. TCP and TLSv1.2) to the same address after I had closed the OpenVPN service.

Here is a screenshot of the 'unencrypted' traffic:

enter image description here

I'm sure that there is some fundamental idea here that I am simply missing... If I need to do more research I would love a shove in the right direction.

Also, for what it is worth I did have at least a couple of other services running during these captures, namely Transmission, Plex, and obviously SSH.

Cheers,

0

45.79.198.112 seems to be used by some apps for checking connectivity. I think your OS is doing the same.

Basically the underlying OS still need to know that it is connected to the Internet and able to route your VPN packets. in order to to do so it connects to certain servers and fetches a file. If successful then then you will see the network icon in the status bar showing "connected" .

| improve this answer | |
  • I am running Ubuntu 16.04 (Ubuntu Server). Not sure what you are inquiring per, the 'where is it running on' it's on a Dell Inspiron N5010 laptop if you're referring to the make/model. – Arie vW Apr 14 '18 at 0:41
  • Jist wanted to know if it's running a physical machine or for example at Cloud machine. I asked for the operating system to try to check for it specifically when I get a chance – Elkady Apr 14 '18 at 1:04
  • Ah, I see, yes it is running on metal. Thank you for taking the time to assist! – Arie vW Apr 14 '18 at 2:18
0

Apparently the IP address 45.79.198.112 is used by Plex as a 'pubsub' server which checks for remote availability. I did not think to do a Google search for the IP but low and behold I found it documented here: https://forums.plex.tv/discussion/220681/plex-media-server-connecting-to-remote-ip

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.