1

What custom TCP/IP packets or other statistics can I use to detect VPN usage?

I understand that this may generate a number of false positives, but my goal is to focus analysis on certain types of traffic.

Possible examples include:

  • Browser reports geolocation doesn't match expected latency to that site is much higher than expected
  • Ping with the DF set
  • Custom packet size + MTU tests
  • SSL protocol features (spdy? fido?)

I'm mostly interested in using SSL/TCP/IP/ICMP to detect such connections... as opposed to browser-DNS leaks, flash, or other approaches, but think other people may find it interesting if you have such a non TCP based detection method.

|improve this question
  • Just to clarify, you want to probe remotely to see if a VPN is in use or you want to perform analysis on traffic as it passes through your network? – RoraΖ May 7 '15 at 16:48
  • @raz I am a web host (or socket server) that wants to detect intentional violations of copyright, but using VPNs to access material outside of designated locations. – goodguys_activate May 7 '15 at 16:54
  • @LamonteCristo off-topic, but if the person paid for it (or has acquired the rights to view the content) then how is it a violation of copyright ? It's because of restrictions like these that pirate sites are successful. – user42178 May 7 '15 at 19:14
1

I don't think you can look at connections and, by inspecting the packets, determine that a VPN is in use. VPNs are meant to look like regular connections.

The only solution I know of is one that blacklists IP addresses belonging to known VPN providers. That can be used effectively though it is a bit of an arms race as VPN providers try to get new addresses all the time to encourage the exact type of usage you are trying to prevent. This thread is an example of what happened when Hulu got the user's VPN IPs on a blacklist.

Even if you use a blacklisting service, you won't be able to identify all VPNs, especiallly if users run their own VPN on a VPS.

Sorry that I don't know of any blacklisting services to recommend but you should be able to find them in Google.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.