dugadugadid
Here is the packet data from the beginning of the connection:
3 2.271502428 192.168.0.23 185.153.179.23 OpenVPN 128 MessageType: P_CONTROL_HARD_RESET_CLIENT_V2[Malformed Packet]
4 2.408065414 185.153.179.23 192.168.0.23 OpenVPN 140 MessageType: P_CONTROL_HARD_RESET_SERVER_V2[Malformed Packet]
5 2.408112350 192.168.0.23 185.153.179.23 OpenVPN 136 MessageType: P_ACK_V1[Malformed Packet]
6 2.408135189 192.168.0.23 185.153.179.23 OpenVPN 429 MessageType: P_CONTROL_V1[Malformed Packet]
7 2.544139626 185.153.179.23 192.168.0.23 OpenVPN 1170 MessageType: P_CONTROL_V1
8 2.544196619 192.168.0.23 185.153.179.23 OpenVPN 136 MessageType: P_ACK_V1[Malformed Packet]
9 2.544342525 185.153.179.23 192.168.0.23 SSL 1158 Continuation Data
10 2.544350808 185.153.179.23 192.168.0.23 SSL 1088 Continuation Data
11 2.544380435 192.168.0.23 185.153.179.23 OpenVPN 136 MessageType: P_ACK_V1[Malformed Packet]
12 2.546812686 192.168.0.23 185.153.179.23 OpenVPN 298 MessageType: P_CONTROL_V1[Malformed Packet]
13 2.680787481 185.153.179.23 192.168.0.23 OpenVPN 191 MessageType: P_CONTROL_V1[Malformed Packet]
14 2.680850134 192.168.0.23 185.153.179.23 OpenVPN 546 MessageType: P_CONTROL_V1[Malformed Packet]
15 2.997241460 185.153.179.23 192.168.0.23 OpenVPN 395 MessageType: P_CONTROL_V1[Malformed Packet]
16 2.997397439 192.168.0.23 185.153.179.23 OpenVPN 136 MessageType: P_ACK_V1[Malformed Packet]
->17 3.080000882 138.197.13.237 192.168.0.23 TLSv1.2 97 Application Data
->18 3.080116886 192.168.0.23 138.197.13.237 TLSv1.2 101 Application Data
19 3.167710422 138.197.13.237 192.168.0.23 TCP 66 443 → 55980 [ACK] Seq=32 Ack=36 Win=11 Len=0 TSval=3143166594 TSecr=63536
22 5.229577240 192.168.0.23 185.153.179.23 OpenVPN 170 MessageType: P_CONTROL_V1[Malformed Packet]23 5.359256474 185.153.179.23 192.168.0.23 OpenVPN 136 MessageType: P_ACK_V1[Malformed Packet]
24 5.359459950 185.153.179.23 192.168.0.23 OpenVPN 388 MessageType: P_CONTROL_V1[Malformed Packet]
25 5.371159025 192.168.0.23 185.153.179.23 OpenVPN 136 MessageType: P_ACK_V1[Malformed Packet]
26 5.435855759 192.168.0.23 192.168.0.1 DNS 74 Standard query 0xd32b A ntp.ubuntu.com
27 5.435931354 192.168.0.23 185.153.179.23 OpenVPN 206 MessageType: P_DATA_V2
This is a capture looking from eth0; at the openvpn tun adapter. This only occurs on NordVPn's SHA512 server ca146udp which uses HMAC SHA512; Which I assumed to be more secure. After this everything looks fine; though there is a leak taking place on packet 17 138.197.13.237 during the malformed packet exchange; Leak taking place whois: DigitalOcean, LLC. My browser was open so is this a false alarm?, It happened while connecting to the VPN; I was in fact connected to my router & the internet with a live connection prior to connecting to the VPN.
What are all these malformed packets and why do they only occur while connecting to the SHA512 VPN? HMAC SHA1 connections do not show malformed packets. I have included an example of a healthy SHA1 connection below.
ca146.nordvpn.com.udp1194.ovpn
================================================================================
# _ _ ___ ______ _ _
# | \ | | ___ _ __ __| \ \ / / _ \| \ | |
# | \| |/ _ \| '__/ _` |\ \ / /| |_) | \| |
# | |\ | (_) | | | (_| | \ V / | __/| |\ |
# |_| \_|\___/|_| \__,_| \_/ |_| |_| \_|
#
client
dev tun
proto udp
remote 185.153.179.23 1194
resolv-retry infinite
remote-random
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
explicit-exit-notify 3
remote-cert-tls server
#mute 10000
auth-user-pass
comp-lzo
verb 3
pull
fast-io
cipher AES-256-CBC
auth SHA512
<ca>
-----BEGIN CERTIFICATE-----
cut
-----END CERTIFICATE-----
</ca>
key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
cut
-----END OpenVPN Static key V1-----
</tls-auth>
block-outside-dns
================================================================================
Malformed packet details:
Frame 12: 298 bytes on wire (2384 bits), 298 bytes captured (2384 bits) on interface 0
Interface id: 0 (eth0)
Encapsulation type: Ethernet (1)
Arrival Time: Feb 27, 2018 17:27:57.076432075 MST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1519777677.076432075 seconds
[Time delta from previous captured frame: 0.002432251 seconds]
[Time delta from previous displayed frame: 0.002432251 seconds]
[Time since reference or first frame: 2.546812686 seconds]
Frame Number: 12
Frame Length: 298 bytes (2384 bits)
Capture Length: 298 bytes (2384 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ethertype:ip:udp:openvpn]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: 00:3c:12:00:36:f0 (00:3c:12:00:36:f0), Dst: HitronTe_68:23:32 (f0:f2:49:68:23:32)
Destination: HitronTe_68:23:32 (f0:f2:49:68:23:32)
Address: HitronTe_68:23:32 (f0:f2:49:68:23:32)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 00:3c:12:00:36:f0 (00:3c:12:00:36:f0)
Address: 00:3c:12:00:36:f0 (00:3c:12:00:36:f0)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.0.23, Dst: 185.153.179.23
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 284
Identification: 0x0516 (1302)
Flags: 0x02 (Don't Fragment)
0... .... = Reserved bit: Not set
.1.. .... = Don't fragment: Set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (17)
Header checksum: 0x074b [validation disabled]
[Header checksum status: Unverified]
Source: 192.168.0.23
Destination: 185.153.179.23
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: 49225, Dst Port: 1194
Source Port: 49225
Destination Port: 1194
Length: 264
Checksum: 0x2e8a [unverified]
[Checksum Status: Unverified]
[Stream index: 0]
OpenVPN Protocol
Type: 0x20 [opcode/key_id]
Session ID: 10823829466654033798
HMAC: ca323b9fe1e4e3891b6a78434c6cefed43a191df
Packet-ID: 3911682019
Net Time: Aug 29, 2037 11:15:01.000000000 MST
Message Packet-ID Array Length: 107
Packet-ID Array
Message Packet-ID Array Element: 3925167123
Message Packet-ID Array Element: 2447741228
Message Packet-ID Array Element: 702769263
Message Packet-ID Array Element: 3162732348
Message Packet-ID Array Element: 1463297651
Message Packet-ID Array Element: 48376510
Message Packet-ID Array Element: 3643212026
Message Packet-ID Array Element: 1560280281
Message Packet-ID Array Element: 2900006912
Message Packet-ID Array Element: 1626
Message Packet-ID Array Element: 2516028417
Message Packet-ID Array Element: 3
Message Packet-ID Array Element: 472538659
Message Packet-ID Array Element: 414253329
Message Packet-ID Array Element: 2
Message Packet-ID Array Element: 369296128
Message Packet-ID Array Element: 1712324608
Message Packet-ID Array Element: 1650525235
Message Packet-ID Array Element: 3644603796
Message Packet-ID Array Element: 2619709386
Message Packet-ID Array Element: 2575050308
Message Packet-ID Array Element: 3055029556
Message Packet-ID Array Element: 3245253675
Message Packet-ID Array Element: 2221134825
Message Packet-ID Array Element: 4164373864
Message Packet-ID Array Element: 1839537955
Message Packet-ID Array Element: 3737410778
Message Packet-ID Array Element: 281907432
Message Packet-ID Array Element: 1143358161
Message Packet-ID Array Element: 38391252
Message Packet-ID Array Element: 841599243
Message Packet-ID Array Element: 3263873695
Message Packet-ID Array Element: 3453491547
Message Packet-ID Array Element: 1141456519
Message Packet-ID Array Element: 3004838802
Message Packet-ID Array Element: 4171309405
Message Packet-ID Array Element: 3109687937
Message Packet-ID Array Element: 1015956004
Message Packet-ID Array Element: 267596181
Message Packet-ID Array Element: 4257652150
Message Packet-ID Array Element: 1580425073
Message Packet-ID Array Element: 2626094100
Message Packet-ID Array Element: 50528257
Message Packet-ID Array Element: 18219779
Message Packet-ID Array Element: 2669102
Message Packet-ID Array Element: 4264893584
Message Packet-ID Array Element: 1255409128
Message Packet-ID Array Element: 874466725
Message Packet-ID Array Element: 780013812
Message Packet-ID Array Element: 2987786855
Message Packet-ID Array Element: 1047858444
Message Packet-ID Array Element: 1152289711
Message Packet-ID Array Element: 3372607179
Message Packet-ID Array Element: 4132778826
[Malformed Packet: OpenVPN]
[Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]
[Malformed Packet (Exception occurred)]
[Severity level: Error]
[Group: Malformed]
=======================================================
NordVPN servers that use HMAC SHA1 does not result in malformed packets. no leaking TLS1.2 handshake occurs to DigitalOcean.
4 3.571728602 192.168.0.23 192.30.89.169 OpenVPN 84 MessageType: P_CONTROL_HARD_RESET_CLIENT_V27 3.616643540 192.30.89.169 192.168.0.23 OpenVPN 96 MessageType: P_CONTROL_HARD_RESET_SERVER_V2
8 3.616707081 192.168.0.23 192.30.89.169 OpenVPN 92 MessageType: P_ACK_V1
9 3.616739000 192.168.0.23 192.30.89.169 TLSv1.2 385 Client Hello
10 3.655547107 192.30.89.169 192.168.0.23 TLSv1.2 1214 Server Hello
11 3.655706914 192.168.0.23 192.30.89.169 OpenVPN 92 MessageType: P_ACK_V1
12 3.655752208 192.30.89.169 192.168.0.23 TLSv1.2 1202 Ignored Unknown Record
13 3.655759719 192.30.89.169 192.168.0.23 TLSv1.2 862 Ignored Unknown Record
14 3.655779505 192.168.0.23 192.30.89.169 OpenVPN 92 MessageType: P_ACK_V1
15 3.658272597 192.168.0.23 192.30.89.169 TLSv1.2 254 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message
16 3.694239527 192.30.89.169 192.168.0.23 TLSv1.2 147 Change Cipher Spec, Encrypted Handshake Message
17 3.694412361 192.168.0.23 192.30.89.169 TLSv1.2 500 Application Data
18 3.761712684 192.30.89.169 192.168.0.23 TLSv1.2 349 Application Data
19 3.761938089 192.168.0.23 192.30.89.169 OpenVPN 92 MessageType: P_ACK_V1
20 4.729656971 192.168.0.17 239.255.255.250 SSDP 216 M-SEARCH * HTTP/1.1
21 5.729818705 192.168.0.17 239.255.255.250 SSDP 216 M-SEARCH * HTTP/1.1
22 5.878182642 192.168.0.23 192.30.89.169 TLSv1.2 126 Application Data
23 5.908965500 192.30.89.169 192.168.0.23 OpenVPN 92 MessageType: P_ACK_V1
24 5.909174721 192.30.89.169 192.168.0.23 TLSv1.2 343 Application Data
25 5.929420758 192.168.0.23 192.30.89.169 OpenVPN 92 MessageType: P_ACK_V1
26 5.993044023 192.168.0.23 192.168.0.1 DNS 74 Standard query 0xf60c A ntp.ubuntu.com
27 5.993153756 192.168.0.23 192.30.89.169 OpenVPN 162 MessageType: P_DATA_V2
28 5.993168060 192.168.0.23 192.30.89.169 OpenVPN 162 MessageType: P_DATA_V2
29 6.016993399 192.168.0.1 192.168.0.23 DNS 138 Standard query response 0xf60c A ntp.ubuntu.com A 91.189.89.199 A 91.189.94.4 A 91.189.91.157 A 91.189.89.198
