Web-Based DNS Test vs Sniffnet

[wakeUPslow]

Hello people, Ill start by saying i stumbled into Sniffnet a few days ago after i somehow stumbled into 'Deb-Get'...I didn't know either existed. Really enjoy Sniffnet and plan on keeping it in my tool bag. Its very easy to use and navigate, i dont have to google how to edit config files and what not. From a beginner/novice computer person pov...great job to the person and or people that made/making this.

I use protonvpn 'paid' account which uses a dummy kill switch to block or route ipv6 traffic to a black hole (null route), as Proton doesn't support ipv6.

Sniffnet is showing traffic (not a lot but enough to cause some concern) on my ipv6leakintrf0 network-adapter which I believe means I'm leaking.

I checked https://browserleaks.com/ and https://www.dnsleaktest.com/, both of which don't show any dns leaks.

I don't have the best understanding of the nature and limitations of web-based tests or Sniffnet, but I'm wondering why the discrepancy between them and which one is right/wrong?

I apologize if this is wrong place to post, I do plan on going to home distro and protonsupport, i just wanted to touch base and see if i could get anyones thoughts while i was here checkin out the app's GitHub

[GyulyVGC]

Hi @wakeUPslow

First of all thanks for your interest in Sniffnet... I'm so happy you are finding it useful!

I need some more info to better understand what's happening:

• is traffic incoming or outgoing from your ipv6leakintrf0? If it's only incoming traffic this shouldn't be a problem
• I assume ipv6leakintrf0 is created by protonvpn... does it expose a private IP address or is it configured in a way to make you system remain anonymous anyway?
• are you sure that traffic on that interface means it's leaked? Maybe it's just probably part of how proton redirects ipv6... to understand this it may be useful to examine src and destination addresses of that traffic: is it directed to your network / outside hosts / one of your other interfaces? If it's not traffic sent outside your system then everything is fine and that's the reason other web based tool don't detect anything

[wakeUPslow]

Hey, thanks for reply and sorry for the vague op/info...I did some investigating to the best of my ability with the help of chatGPT (had a crash course in tcpdump)and sent my findings to proton support.

Too try and answer your questions....

• 1. Traffic Direction on ipv6leakintrf0:
     • The observed traffic is outgoing from the ipv6leakintrf0 interface. This was identified using network monitoring tools like tcpdump, which captured IPv6 packets being sent from this interface. If it were only incoming traffic, it might be less concerning, but the outgoing nature of the traffic suggests potential issues, given ProtonVPN’s policy to block IPv6.
  2. Nature of ipv6leakintrf0 Interface:
     • The ipv6leakintrf0 interface appears to be associated with ProtonVPN. The IPv6 address observed (fdeb:446c:912d:8da::) seems to be a Unique Local Address (ULA), which is typically used for local communications within a network and not routable on the public internet. This kind of address is generally used to maintain privacy and anonymity within a network.
  3. Interpreting Traffic on ipv6leakintrf0:
     • The main concern is whether the traffic on this interface indicates a leak. The traffic captured was directed to external IPv6 addresses, not just within the local network or to another interface on the same device. This includes connections to various external servers, primarily using HTTPS (port 443).
     • While it’s possible that this traffic is part of ProtonVPN’s method of handling or redirecting IPv6, the concern arises from the fact that it’s not expected behavior as per ProtonVPN’s stated policy of blocking IPv6 to prevent leaks. The external destinations of this traffic further add to the concern.
     • The reason web-based tools might not detect this as a leak could be due to their focus on DNS queries specifically, while the observed traffic includes general IPv6 communication attempts.

In summary, the outgoing nature of the traffic, its external destinations, and the use of a ULA on the ipv6leakintrf0 interface are key points that need clarification to determine whether this is part of normal VPN operation or indicative of a configuration issue or leak.

Thanks for your response and your time

[GyulyVGC]

I think in this case the best thing to do is to contact directly the proton support as you did.
They'll surely be able to tell you more about this concerns.
Anyway, I'm happy that Sniffnet helped you to monitor more in detail what's going on... in these situations is always good to have a clear understanding of the network to be sure that privacy is actually not compromised.

I remain available in case of other needs or curiosities.