Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am more interested in an answer to the above question for my own privacy. I am curious how secure using a VPN is, especially on a larger or public network. If you know someone is monitoring the traffic and you use a VPN, how difficult and/or what are the best methods used to recording VPN packets? When using an unsecured WIFI how easy is it for the Admin to record your encrypted packets?

Thanks for any help and clarification!

share|improve this question
If you are using an unsecured WiFi there is no encryption on the network level, so anyone who can receive the on-the-air packets can see what's going on at the IP level. If you have a properly configured VPN using encryption it's pretty hard for a third party to listen in to the traffic that goes through the VPN (that's kind of the whole idea). This question is a little bit like "I heard that airplanes can crash. How often does a bus need to refuel?". Both WiFi and VPNs can or do use encryption, but being able to do anything with one doesn't necessarily do anything with the other. – Michael Kjörling Jul 18 '13 at 16:52
If you are connected to a VPN the only traffic anyone could monitor was any unencrypted traffic sent to the VPN itself. – Ramhound Jul 18 '13 at 16:53
What if you were concerned someone was using your Wireless connection to access the internet and you suspected they used a VPN? Besides making the Wireless node more secure, what is the best way to catch them? Or is there a way. – andrsnn Jul 18 '13 at 16:56
Also thank you for the down vote! you are all so kind! – andrsnn Jul 18 '13 at 16:57
Please don't ask hypothetical questions. The general suggestion is to "only ask practical, answerable questions based on actual problems that you face.". – Michael Kjörling Jul 18 '13 at 17:01
up vote 1 down vote accepted

When you use an unsecured Wifi access point, your packets are sent in the clear. This means anyone who can set their Wifi card into monitoring mode can sniff and capture all traffic (that means ALL traffic from EVERYONE on the Wifi access point) that passes through that Wifi access point. The software to do this requires some technical prowess, and you need a Wifi adapter that supports monitoring mode, but isn't super difficult.

When you use a secured Wifi access point, your packets are encrypted. WEP is super easy to break using tools. WPA is possible to break, and WPA2 is hard to break (must be brute forced AFAIK). So no one who is not on the Wifi network can sniff and capture traffic.

If you use a VPN, or access a site via HTTPS, the transmission between you and the site is encrypted. If you do this on an unsecured wireless network, someone who may be capturing traffic will only see ciphertext. If they know anything about the keys, passwords, or certificates involved, they may be able to later decrypt the traffic. Decrypting a capture of such traffic is involved and difficult, and could be practically impossible if you are using a VPN with strong encryption and good enough passwords or private keys.

Now it is possible to run software on a Wifi access point, or on a device immediately after the access point but before the router it uses for Internet connectivity, to capture all traffic that has come in "after" the wireless network. Wireless encryption cannot prevent this. This is moderate to difficult but I doubt most people at most public Wifi spots would be capturing and analyzing traffic, but it is certainly possible.

However, if you are using a VPN or accessing sites via HTTPS, you are protected in the same way from this as described above.

share|improve this answer
So a man in the middle type of attack? Thank you very much! I now understand clearly. – andrsnn Jul 18 '13 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .