Is it possible to track someone's activity when he uses a VPN using packet beat. Like detect that he opened a VPN and see his browsing activity for example.
What's visible to Packetbeat depends on where you are monitoring from. If you are monitoring on the host with the VPN connection you can most likely inspect traffic before it enters the tunnel.
If you're monitoring somewhere upstream on the network then you'll just see VPN traffic. If it's a VPN over TLS you could configure Packetbeat to inspect the TLS handshake which would get you info the certificate(s) exchanged when establishing the connection. And then you could probably use this info to determine that the traffic is associated with a VPN.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.