Forgive me if this is not the appropriate place to ask this.

I was capturing some traffic on my home server during an active OpenVPN session using Mullvad recently and I noticed that the traffic is predominantly UDP which would make sense per the .conf file:

dev tun
proto udp

However I noticed that there was some traffic using TCP and TLSv1.2 to an IP address that I do not recognize.

Here is a screenshot of the partial capture showing the TCP traffic:

enter image description here

Here is a screenshot of the partial capture without the TCP filter:

enter image description here

However the strange part to me was that I was seeing this same traffic (ie. TCP and TLSv1.2) to the same address after I had closed the OpenVPN service.

Here is a screenshot of the 'unencrypted' traffic:

enter image description here

I'm sure that there is some fundamental idea here that I am simply missing... If I need to do more research I would love a shove in the right direction.

Also, for what it is worth I did have at least a couple of other services running during these captures, namely Transmission, Plex, and obviously SSH.



2 Answers 2

0 seems to be used by some apps for checking connectivity. I think your OS is doing the same.

Basically the underlying OS still need to know that it is connected to the Internet and able to route your VPN packets. in order to to do so it connects to certain servers and fetches a file. If successful then then you will see the network icon in the status bar showing "connected" .

  • I am running Ubuntu 16.04 (Ubuntu Server). Not sure what you are inquiring per, the 'where is it running on' it's on a Dell Inspiron N5010 laptop if you're referring to the make/model.
    – Arie vW
    Apr 14, 2018 at 0:41
  • Jist wanted to know if it's running a physical machine or for example at Cloud machine. I asked for the operating system to try to check for it specifically when I get a chance
    – Elkady
    Apr 14, 2018 at 1:04
  • Ah, I see, yes it is running on metal. Thank you for taking the time to assist!
    – Arie vW
    Apr 14, 2018 at 2:18

Apparently the IP address is used by Plex as a 'pubsub' server which checks for remote availability. I did not think to do a Google search for the IP but low and behold I found it documented here: https://forums.plex.tv/discussion/220681/plex-media-server-connecting-to-remote-ip

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .