For example: I'm browsing my favorite website with my favorite VPN enabled. I disable my VPN while I'm still on a page of the website. I haven't clicked any links yet, I haven't went back to the previous page, I'm just on the page, touching nothing. At this point, are the web server and ISP now aware of this change? Or does a page refresh / new request have to occur?

If I had to guess, it would be no, because it would be theoretically the same thing as viewing the webpage and disconnecting your internet completely. Am I on the right track?

  • 7
    For all of the reasons stated in the answers already given, good security practice is to configure your VPN client to drop your network connection upon termination of the VPN. You don't want automatic reconnects outside the VPN. – user10216038 Apr 29 at 23:49
  • The answers have already stated that most websites make requests in the background so I thought I'd add that pressing CTRL+SHIFT+i in most browsers opens the developer console where, in the Network tab you can see all the requests being made in the background. – TR_SLimey Apr 30 at 15:36

In the early days of the web, webpages were mostly static and there would be no communication between your computer and the web server unless you were actively loading a page. Today, that is no longer true. It it extremely common for webpages to maintain active connections to provide features like live updates. When you see a new email appear in Gmail without refreshing, or when you see an incoming chat message, those features are powered by active connections. This very page is likely using them to alert you to new answers. It is also common to try to automatically restore these connections when there is a network interruption.

Even if the webpage doesn't have any features that would benefit from live updates, it is possible that there are still connections established for analytics and advertising purposes.

To be safe, you should assume that when you disconnect from VPN, any pages you have open can immediately pick up on the change.

| improve this answer | |
  • 12
    When you connect to or disconnect from the VPN (or the Internet) the OS will generally send a network change event to interested processes like web browsers. That the web page will be aware of the change is therefore a good assumption. – Michael Hampton Apr 29 at 11:56
  • Some years ago, I wrote video chat software using Flash. IIRC, when you maintained a stream from one party to the other, if the network on the client machine changed (for example, if they changed Wi-Fi networks), you would get a sort of "network-changed" event. – Panzercrisis May 1 at 15:57

It depends on the site.

Does the website have any javascript function sending data back from time to time? Open the Developer Tools on your browser, go to the Network tab and watch. If there's connections from time to time, the website knows your IP changed.

If the site have Websockets (thanks Jon for pointing this), there's one caveat: already established websocket connections will not show on the Network tab even if they are sending or receiving data, they only show on the tab when they are connecting. The WebSocket Echo test can show you this. Open the page, open the Dev Tools, and click on Connect on the test page. The connection shows on the Network Tab. Close the DevTools, reopen it, and send any data using the Test page: nothing shows on the Network tab.

If after finishing loading the page, the Network Tab is silent, no, it does not know. But one request is enough.

| improve this answer | |
  • 2
    The network tab won't show data sent on websockets that were opened before the inspector window. For example, this site doesn't show traffic when "a question has been edited" message is shown. I don't know very much about the WS protocol, would the connection remain open for data to be sent? – Jon Apr 30 at 2:27
  • You are correct. The network tab won't show any traffic on any already established websocket connection. – ThoriumBR Apr 30 at 12:15

The other answers talk about web sites, but you also ask about ISPs. The same basic answer applies that once you disable your VPN, the next request would go straight to the destination server (e.g. the website) and not through your VPN, so your ISP would see the destination of your traffic as the actual destination and not a server owned by the VPN provider. However, unlike a web site that almost certainly has some information transmitted on each request to maintain state, the ISP would not have an immediately available way to know that you were previously connected to the website when you were routing through the VPN just because they now know you are connected to it. The ISP might be able to determine this based on contextual information from your requests, but not just from the new connection alone.

| improve this answer | |

One more point in addition that fact that pages can connect on their own without you touching them is that there are other protocols beside HTTP.

  • You can have an email client which connects to the email server via SMTP (say, Thunderbird)
  • You can have a timekeeping system which connects to a time source on a regular basis (time.microsoft.com for Windows for instance)
  • You can have a client which connects to a server (say, Dropbox - that would be via HTTP but it is not a web page)

Any much more.

You can have a look at what moves from/to your computer by installing Wireshark, launching it and grabbing some popcorn to see the circus which is today's networking.

So the answer to your question is: yes, very likely.

It also depends on what you mean by immediately - there is no signal from your computer which does "hey everyone, the VPN was disconnected", this is an indirect consequence of the richness of the traffic.

| improve this answer | |

Merely disabling your VPN would not generate any new traffic alerting the remote service that you had been connected to through it. Any new traffic would likely alert the remote site to the change as your IP would have changed. This traffic might be generated automatically without user intervention through JS on the page, or some other process.

Your ISP might observe that traffic to the VPN endpoint has stopped. Traffic analysis is such that they can likely guess that the connection is VPN related if they care.

Disabling a VPN is not like disconnecting from the internet, it is more like instantaneously switching wifi networks. Your existing connections will be clobbered, but any outgoing app can still attempt new connections possibly revealing information relating the first connection to the other, and you!

| improve this answer | |

Some websites like facebook, twitter generally send ajax request with the interval of times and which happens behind the notice of person browsing the website, even he/she is not touching any part of the website. So yes if you open such site, it will send request to the destination server exposing your IP even you leave that website idly.

| improve this answer | |
  • 1
    Hello MHJ and welcome to Information Security. Your answer doesn't really contain anything that isn't already covered in more detail in other answers. Since you're a new contributor, that's fine, and it's good to get your feet wet while answering. Just for the future, please try to add something new when providing an answer to a question that already has existing answers (e.g. more details, authoritative reference, a different perspective, etc.) – MechMK1 Apr 29 at 17:17

I think this comes down to how you define what "aware of the change" means. If you mean that a bell rings somewhere and a special task force springs into action to investigate, then no.

The reality is that the web server and ISP largely don't care. This kind of thing happens so often, in so many different ways, all with the same end result, and there is no reason to track it. It will be just like disconnecting your internet completely. Or less dramatic, switching to another web page.

Your client may have open resources (i.e., sockets) on the web server that will eventually get closed. Is that because the web server is "aware" of something you did? Not really. It's because those resources have timeouts and are automatically closed when the connection fails enough times, or when there is lack of activity.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.