I am checking that my VPN is really encrypting connection, using wireshark.

When I capture from the WiFi interface the data is encrypted by openvpn protocol, but when I capture Local Area Connection (TAP-Windows Adaptor v9) then I see unencrypted data.

My question: Is my VPN leaving data unencrypted, or it is normal that VPN has unencrypted data in its own adaptor and it is a part of encryption?

  • You might wish to test this using two computers. This would more closely resemble an actual man in the middle attack that you are trying to simulate. Setup Wireshark and WiFi hotspot on the second computer. Try communicating through the hotspot with the first computer. Start without VPN to make sure you can see the relayed plaintext traffic. Then turn on the VPN and confirm that the plaintext traffic is no longer visible.
    – cyberixae
    Jan 8, 2021 at 12:30

1 Answer 1


This is expected as you are capturing the traffic before it enters the VPN tunnel i.e. before it is encrypted.

  • 9
    In other words, the TAP interface is the door through which traffic enters the VPN. Tracing traffic at the door gives you the original. What you trace at the Wifi interface is encrypted traffic leaving the computer. Jan 2, 2021 at 5:17
  • 2
    It's like your Wireshark session is the bouncer to the VPN club, checking IDs at the door. Jan 4, 2021 at 2:19
  • 1
    @AsteroidsWithWings - I'm stealing that analogy!
    – warren
    Jan 4, 2021 at 19:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .