VPN Traffic Detection

Zeek
1

Hello,

anyone has ever tested a way to detect VPN Traffic? Could BRO detect the connection initiation? After reading the RFC about ISAKMP I have found some characteristics about this protocol that could help detect it but I don’t want to reinvent the wheel and there are other protocols used in VPN tunneling. Ideas anyone??

2

          anyone has ever tested a way to detect VPN Traffic?

If it's using IPSEC, then it should be easy to detect due to use of
well-known ports. That said, Bro doesn't have any IPSEC analyzers
(if you're interested in contributing some, please let us know!).

    Vern