How to check if all network traffic is being routed through vpn?

Question

I am connected to an ssh vpn on my mac, but I want to make sure all of my web traffic is running though it. How can I do that? Web traffic here can mean anything from http/s/ to udp tcp, to anything that goes from my computer to another, not in my house. Any ideas?

Solution

Firstly, 'web traffic' is only http and https.

You mean 'internet traffic' - the web and the internet are two entirely different things.

And the tool you are looking for is traceroute or tracert on windows.

C:\> tracert www.google.com

or

$ traceroute www.google.com

and watch the machines the traffic is going through.

Oh, and what is a 'ssh vpn'? SSH doesn't do VPNs - it does port forwarding.

Comments

[DCIndieDev]

Just to clarify, its a vpn over ssh, not an ssh vpn. In other words I connect to the vpn via ssh. Help?

[FJ de Brienne]

Still not clear on how you achieve this. Are you actually routing a network protocol over SSH? (such as PPP over SSH?)

[DCIndieDev]

well whats problematic is that I didnt set this one up myself so I know only what I am told. Lemme go research it a bit and comment back here.

[Arjan]

In Wireshark, can one listen to a specific software network interface? (Like the non-VPN to see what's not using that, rather than all traffic on a hardware NIC?)

[Brian]

Looking real quickly, it doesn't seem like it - although you could probably define a filter to select out the appropriate packets...Ask Wireshark is a good resource

[Florenz Kley]

@arjan - of course you can. start it as wireshark -i <interfacename> or use "Capture -> Interfaces" from the menu.

[Arjan]

@Florenz, you may be right, but are you sure it lists VPN connections? (And not only the ethernet and wireless cards? For this very question, listening to the hardware is not sufficient. Both non-VPN and VPN will use the same hardware.)

[Florenz Kley]

@Arjan - that would depend on the type of VPN. With a SSH VPN, no problem IMO, as the interface itself is not touched, and no additional pseudo-interface is allocated. No such luck with IPSec - you are right there, listening to the underlying HW interface only captures a lot of esp and ah packets.