# Detecting OpenVPN **URL:** \ **Category:** Zeek\ **Created:** [June 15, 2018, 7:47am UTC](https://community.zeek.org/t/detecting-openvpn/5354 "2018-06-15T07:47:53Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [June 15, 2018, 7:47am UTC](https://community.zeek.org/t/detecting-openvpn/5354/1 "2018-06-15T07:47:53Z")
All, Before I set out to re-invent the wheel, yet again, I thought I’d post the question to this list first. Is anyone aware of any work that’s been done to get OpenVPN detection in Bro? Just getting detection on the handshake/initial connection should be a good enough start in my book. Wireshark have OpenVPN protocol support so it seems to be doable. Any feedback/ideas out there? Thanks in advance, Mike ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [June 15, 2018, 9:27am UTC](https://community.zeek.org/t/detecting-openvpn/5354/2 "2018-06-15T09:27:54Z")
Maybe the initial SSL handshake is unique enough to warrant JA3 signature? The SSL analyzer does not attach there, but maybe that’s because it’s UDP? Johanna? ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [June 15, 2018, 9:43am UTC](https://community.zeek.org/t/detecting-openvpn/5354/3 "2018-06-15T09:43:59Z")
Michal, I didn’t think about JA3, that could possibly be a good avenue to go down. OpenVPN can run over TCP as well as UDP, but UDP seems to be most prevalent. If I look at captures there seems to be some patterns that could possibly be used to trigger detection. In the attached screenshot[1] you can see some sample UDP traffic. With the two RESET messages followed by the ACK and then TLS Client and Server Hello’s there might be an way in? Cheers, Mike [1] ![image.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f0e568a0675e87a4351b3e2fba2b1f144bc7095a.png) ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [June 15, 2018, 9:47am UTC](https://community.zeek.org/t/detecting-openvpn/5354/4 "2018-06-15T09:47:14Z")
Just checked that the SSL analyzer does not attach to OpenVPN over TCP (we support both protocols). I’d like to know, why and possibly get that fixed. OpenVPN should be quite easy to detect at the ssl layer, or we could have an OpenVPN protocol maybe. ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [June 15, 2018, 9:57am UTC](https://community.zeek.org/t/detecting-openvpn/5354/5 "2018-06-15T09:57:05Z")
If it can be fixed in ‘core’ Bro it would be even better than writing my own detection. I’m sure more people than us would be interested in this? Cheers, Mike ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [June 15, 2018, 2:45pm UTC](https://community.zeek.org/t/detecting-openvpn/5354/6 "2018-06-15T14:45:59Z")
Is OpenVPN just "normal" TLS? (I admittedly just never looked at it). If yes, that would be a bug. Do you randomly have a short pcap that you can share that shows this? Johanna ---
**Author:** ![Steve\_Brant](https://avatars.discourse-cdn.com/v4/letter/s/858c86/32.png) [@Steve\_Brant](https://community.zeek.org/u/Steve_Brant)\ **Post date:** [June 15, 2018, 9:04pm UTC](https://community.zeek.org/t/detecting-openvpn/5354/7 "2018-06-15T21:04:59Z")
Check out JA3 as a method of identifying clients. [https://github.com/salesforce/ja3](https://github.com/salesforce/ja3) I did a little work on it last year. There are other relevant links here [https://www.splunk.com/blog/2017/12/18/configuring-ja3-with-bro-for-splunk.html](https://www.splunk.com/blog/2017/12/18/configuring-ja3-with-bro-for-splunk.html) Thanks, Steve ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [June 15, 2018, 9:34pm UTC](https://community.zeek.org/t/detecting-openvpn/5354/8 "2018-06-15T21:34:26Z")
Like we said previously it did not work. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/detecting-openvpn/5354/9 "2022-05-06T15:45:52Z")