Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm designing a developer tool that would analyse and debug arbitrary network connections, but I want to provide it as a service rather than software to be installed locally.

Ideally I would like to save all inbound and outbound packets on a per-user basis to a database.

For example:

  1. The developer connects the machine running his software to the VPN.
  2. The developer then runs his software, which may connect to arbitrary hosts.
  3. Traffic is routed through the VPN, where it is logged.
  4. The developer can then access the logs for that session.

I'm having difficulty figuring out how to address the third step.

I've read the manual, searched the web, and searched Server Fault, but I suspect I'm missing a piece of the puzzle somewhere. Do I need an additional tool to sniff the virtual interface or can OpenVPN handle this somehow?

share|improve this question
Please add more detail to your question. How are you planning on capturing network traffic on an arbitrary host without having any software installed on it? – kce Apr 9 '13 at 16:59
The traffic is routed through the VPN. I've updated the question to give more details. – Jim Apr 9 '13 at 17:45
up vote 2 down vote accepted

OpenVPN by itself doesn't sniff anything, but you can use standard sniffing tools.

If you configure OpenVPN to operate in tunnel mode, then the connection between the application host and your server will appear on a virtual interface (with a name like tun0 on unix-like hosts) with its own IP address on each side. From the point of view of the application, your server will appear as if it was physically on the same network of the application host, and acting as a router, so any sniffing tool that works on regular network interface to obtain the data that you need will do.

I would do more or less something as follows

  • Have the user connect to the VPN (of course OpenVPN has to be configured to route all the traffic through the VPN server).
  • Server-side, configure an hook that registers the time of the connection, the user and the IP address it is using
  • (optionally) server-side, configure another hook on disconnection that register the event.

Meanwhile, have a sniffing program running on the VPN virtual device that continuosly grabs a packet from the interface, looks at the remote address, match it with the current list of users, and save it in the database. It will probably be a combination of a standard sniffing tool for extracting the the packet from the network interface and a custom tool that parses the packet, extract the information you need and save it somewhere.

share|improve this answer

You will need to sniff the traffic as it leaves the OpenVPN TUN or TAP interface on your computer that is acting as the VPN endpoint. There's no magic here (or at least none than I can think of). An interface, is an interface, is an interface.

OpenVPN does not provide native functionality for packet sniffing but there are plenty of purpose-built tools to perform that duty such as tcpdump or tshark/wireshark.

share|improve this answer

How does OpenVPN fits in the picture, really?

I have a vague feeling you read somewhere that Linux supports "virtual" network interfaces, whose types are called "TUN" and "TAP" (for IP-tunnel-style and Ethernet-style interfaces, respectively), so you googled and the search turned up OpenVPN which happens to name the types of its interfaces the same way (because I beleive it uses the same kernel machinery on Linux).

I reckon that in fact you're looking after the direct manipulation of those virtual interfaces which allows you to create your own network interfaces, which effectively pass all the traffic coming over them through your user-space application.

share|improve this answer
You're doing an awful lot of incorrect guesswork there. As I state in my question, the application being debugged will not be running on the same host as the debugging tool, in fact it won't be running on the same physical network even. In order for the debugging tool to operate, it will need access to the traffic flowing between arbitrary hosts, one of which will be operated by the developer. – Jim Apr 5 '13 at 20:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.