I am trying to learn more about the IPSec and VPN. I am using TunnelBear on Firefox. When I start VPN service, I only see TLS connections on Wireshark but not the ISAKMP or other IPSec related packets. I did another trial with the Cisco AnyConnect client and connected to my school. Still I see TLS connections but nothing about IPSec related messaging. In my test setup I am using my Windows PC and the required VPN software. The servers I am trying to connect should be VPN servers.

Do these programs use another method to connect to those servers? Why do I only see TLS connections? Thanks.

1 Answer 1


There are several other VPN protocols apart from IPSec. Specifically Tunnelbear and Cisco AnyConnect always use or can optionally use the OpenVPN protocol, which means you will not see any IPSec traffic in this case.

  • Thank you for the answer. I am a little disappointed to be honest. Do you know any application or example where IPSec is really used? It looks like OpenVPN is used more in these applications. Or the question can be that as well; when should I use IPSec?
    – nsrdn
    Oct 25, 2020 at 15:46
  • @nsrdn: Very roughly: IPSec is often used to connect larger installations (i.e. site to site VPN) and less used to connect single users (but there are still products which do this). OpenVPN is more used to connect single users since it is easier to setup and plays better with NAT or firewalls in between. And then there is the newcomer Wireguard which is designed for even more simplicity. Commercial VPN providers targeting home users usually use OpenVPN and recently also Wireguard. Oct 25, 2020 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .