I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input.

I have a vpn set up to an adapter, tun0, when i connect to my vpn and initiate a plaintext SMTP connection to a server, I can see the plaintext in wireshark from tun0.

I would expect this through a normal adapter, however did not expected this would be captured as unencrypted on my tunnel adapter and dont know where the fallacy in my knowledge is! my vpn is using rsa keys for the encryption.

Perhaps its encrypted after the capture or something, just before being sent out? I dont have the hardware to set up a mitm outside of my computer to capture it as it passes along the wire to confirm. Please Can anyone help / point me where i should be looking for an answer?


1 Answer 1


tun0 is the virtual tunnel interface where the traffic gets routed to before encryption (outgoing) or after decryption (incoming) - so seeing plain traffic here is perfectly normal. To observe the encrypted traffic you have to sniff the interface representing the physical network card, i.e. something like eth0, wlan0 or whatever it is named on your system.

-- plain traffic --[tun0 - encryption/decryption - eth0]-- encrypted traffic --
  • Thankyou for providing an explanation, very helpful:D
    – joboi_lax
    Nov 30, 2023 at 9:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .