17

I know that my ISP can detect when I am using a VPN, but can it see which protocol I am using?

1
  • 3
    Wireshark can identify the protocol based on packet analysis, OpenVPN for example, Do the test.
    – Anonymous
    Apr 13 at 19:04
22

Yes, probably. Most VPN protocols are not designed to hide the fact that they're VPN protocols, nor what kind of protocol they are. See for instance this paper which details fingerprinting OpenVPN.

If you run all your traffic through a VPN, the fact that you're using a VPN is quite easily visible - as all traffic will be destined for a single destination - which is quite unlike normal usage patterns.

If you're interested in hiding the fact that you're using a VPN, and what VPN, you should probably look into what's used in totalitarian states, such as China, which routinely blocks all attempts at VPNs out of China. Tor is one such system.

10
  • 1
    It might not be that unusual of a usage pattern. The same pattern would be seen when connecting to a remote session (SSH, RDP, …) and working remotely. Though only if you're not doing any other web browsing on the side on your end. Apr 14 at 7:41
  • 5
    @KonradRudolph and if you don't even have a web browser open, and no automatic updates for your operating system, no Microsoft apps that phone home, no Google apps that phone home, you type at 30000000 WPM, ...
    – user253751
    Apr 14 at 9:40
  • 1
    @user253751 I considered adding that caveat to the comment but this isn’t necessarily true: even when you use a VPN, not all network traffic necessarily goes via the VPN. Often that’s unnecessary and costly. Apr 14 at 9:43
  • 1
    @user253751, in fact all of that is not a problem. There are VPNs where the local client simply sets up the local routes such that all traffic goes over the VPN. Even local browsing or your local Windows Update would run over the VPN. This was the case in my company's infrastructure, for example, before it was changed when everybody went home due to COVID and the VPN infrastructure was overloaded thus.
    – AnoE
    Apr 14 at 10:54
  • 1
    @KonradRudolph I'd consider SSH tunnelling a VPN for all intents and purposes.
    – vidarlo
    Apr 14 at 18:20
2

Yes they could, but they would need to do this actively. Some degree of effort is required. If you are one user in many that share an ISP connection there would need to be filtering, grouping going on. They also might not care. Your employer will care if you are breaking rules though. A disproportionate level of SSL traffic on 443 to a single address might be noticeable. (They have to keep some ports open).

But your ISP, unless they have a real reason to care, they won't. VPN's are pretty much mandatory for protecting personal information or joining your private network.

I daresay a very large number or people have been working from home lately. That's a lot of VPN traffic.

You probably have more to fear from a provider if it is not "your" VPN. They may say they don't "keep" logs, but that does not mean someone else is not archiving traffic.

7
  • It's worth highlighting that last part. Third party VPN providers are less trustworthy than your real-world ISP. Even if you think the various things they enable (e.g. copyright infringement, fooling streaming services about your location) are OK, consider this: using a third-party VPN indicates you're doing something you want to keep secret — you've self-identified as "interesting". If I were an intelligence agency, I'd be running multiple "competing" third-party VPN providers myself, so that I could inspect all that juicy traffic without having to get warrants or cooperation from ISPs.
    – al45tair
    Apr 15 at 6:17
  • 1
    @alastair Using a 3rd party VPN does NOT imply I want to keep a secret. I want to keep ALL my secrets. My ISP can know I sent encrypted TCP/IP packets to the VPN server, and received encrypted TCP/IP packets from the VPN server. Can my ISP decrypt the packets? Design says no, but if your ISP has a technological government funded agency behind it ... Tracking the unencrypted packets from/to the VPN server and the desired URI can he done, but associating a particular packet with a particular VPN packet can't be done.
    – waltinator
    Apr 17 at 23:31
  • @waltinator You're only keeping "your secrets" from your ISP, however. (Possibly you're also trying to disguise your actual location from third parties.). Also, there is one party who can track the traffic right back to you — the VPN provider themselves. And, as I say, they're likely considerably less trustworthy than your actual ISP, and you're feeding all your traffic through them.
    – al45tair
    Apr 18 at 13:32
  • 1
    @alastair Support your assertion "they (VPN provider) are likely less trustworthy .. ". Explain what you mean by "trustworthy". VPNs can be designed to change packet routing (within their multi-node internal networks) on a per-packet level. My ISP is subject to the court of my jurisdiction.
    – waltinator
    Apr 18 at 17:31
  • 1
    "Virtual Private Networks" is a field of research and practice in Computer Science and Industry. You seem to lack familiarity with this field.
    – waltinator
    Apr 19 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.