Scribd
Upload
9 views4 pages

OpenVPN Connection Log Analysis

This JSON log file documents the initialization and connection of an OpenVPN client on Windows. It records details like the OpenVPN and library versions used, management commands, authentication steps, and network configuration changes like routing table additions and deletions when the VPN connection is established and terminated.

Uploaded by

kikito
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
9 views4 pages

OpenVPN Connection Log Analysis

This JSON log file documents the initialization and connection of an OpenVPN client on Windows. It records details like the OpenVPN and library versions used, management commands, authentication steps, and network configuration changes like routing table additions and deletions when the VPN connection is established and terminated.

Uploaded by

kikito
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Fri Nov 24 07:31:06 2017 OpenVPN 2.4.

4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11]


[AEAD] built on Sep 26 2017

Fri Nov 24 07:31:06 2017 Windows version 6.2 (Windows 8 or greater) 64bit

Fri Nov 24 07:31:06 2017 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10

Enter Management Password:

Fri Nov 24 07:31:07 2017 MANAGEMENT: TCP Socket listening on [AF_INET][Link]:25340

Fri Nov 24 07:31:07 2017 Need hold release from management interface, waiting...

Fri Nov 24 07:31:07 2017 MANAGEMENT: Client connected from [AF_INET][Link]:25340

Fri Nov 24 07:31:07 2017 MANAGEMENT: CMD 'state on'

Fri Nov 24 07:31:07 2017 MANAGEMENT: CMD 'log all on'

Fri Nov 24 07:31:07 2017 MANAGEMENT: CMD 'echo all on'

Fri Nov 24 07:31:07 2017 MANAGEMENT: CMD 'hold off'

Fri Nov 24 07:31:07 2017 MANAGEMENT: CMD 'hold release'

Fri Nov 24 07:31:25 2017 MANAGEMENT: CMD 'username "Auth" "[Link]-kiki1"'

Fri Nov 24 07:31:25 2017 MANAGEMENT: CMD 'password [...]'

Fri Nov 24 07:31:25 2017 WARNING: No server certificate verification method has been enabled.
See [Link] for more info.

Fri Nov 24 07:31:26 2017 TCP/UDP: Preserving recently used remote address:
[AF_INET][Link]:25000

Fri Nov 24 07:31:26 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]

Fri Nov 24 07:31:26 2017 UDP link local: (not bound)

Fri Nov 24 07:31:26 2017 UDP link remote: [AF_INET][Link]:25000

Fri Nov 24 07:31:26 2017 MANAGEMENT: >STATE:1511483486,WAIT,,,,,,

Fri Nov 24 07:31:26 2017 MANAGEMENT: >STATE:1511483486,AUTH,,,,,,

Fri Nov 24 07:31:26 2017 TLS: Initial packet from [AF_INET][Link]:25000, sid=aadebd53
98e45a93

Fri Nov 24 07:31:26 2017 WARNING: this configuration may cache passwords in memory -- use the
auth-nocache option to prevent this

Fri Nov 24 07:31:26 2017 VERIFY OK: depth=1, C=id, ST=id, L=[Link], O=[Link],
OU=[Link], CN=[Link], name=[Link], emailAddress=contact@[Link]

Fri Nov 24 07:31:26 2017 VERIFY OK: depth=0, C=id, ST=id, L=[Link], O=[Link],
OU=[Link], CN=[Link], name=[Link], emailAddress=contact@[Link]

Fri Nov 24 07:31:28 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-
SHA384, 2048 bit RSA
Fri Nov 24 07:31:28 2017 [[Link]] Peer Connection Initiated with
[AF_INET][Link]:25000

Fri Nov 24 07:31:29 2017 MANAGEMENT: >STATE:1511483489,GET_CONFIG,,,,,,

Fri Nov 24 07:31:29 2017 SENT CONTROL [[Link]]: 'PUSH_REQUEST' (status=1)

Fri Nov 24 07:31:29 2017 AUTH: Received control message: AUTH_FAILED

Fri Nov 24 07:31:29 2017 SIGUSR1[soft,auth-failure] received, process restarting

Fri Nov 24 07:31:29 2017 MANAGEMENT: >STATE:1511483489,RECONNECTING,auth-failure,,,,,

Fri Nov 24 07:31:29 2017 Restart pause, 5 second(s)

Fri Nov 24 07:32:07 2017 MANAGEMENT: CMD 'username "Auth" "[Link]-kiki1"'

Fri Nov 24 07:32:07 2017 MANAGEMENT: CMD 'password [...]'

Fri Nov 24 07:32:07 2017 WARNING: No server certificate verification method has been enabled.
See [Link] for more info.

Fri Nov 24 07:32:07 2017 TCP/UDP: Preserving recently used remote address:
[AF_INET][Link]:25000

Fri Nov 24 07:32:07 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]

Fri Nov 24 07:32:07 2017 UDP link local: (not bound)

Fri Nov 24 07:32:07 2017 UDP link remote: [AF_INET][Link]:25000

Fri Nov 24 07:32:07 2017 MANAGEMENT: >STATE:1511483527,WAIT,,,,,,

Fri Nov 24 07:32:07 2017 MANAGEMENT: >STATE:1511483527,AUTH,,,,,,

Fri Nov 24 07:32:07 2017 TLS: Initial packet from [AF_INET][Link]:25000, sid=e08d3567
23f9853d

Fri Nov 24 07:32:08 2017 VERIFY OK: depth=1, C=id, ST=id, L=[Link], O=[Link],
OU=[Link], CN=[Link], name=[Link], emailAddress=contact@[Link]

Fri Nov 24 07:32:08 2017 VERIFY OK: depth=0, C=id, ST=id, L=[Link], O=[Link],
OU=[Link], CN=[Link], name=[Link], emailAddress=contact@[Link]

Fri Nov 24 07:32:08 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-
SHA384, 2048 bit RSA

Fri Nov 24 07:32:08 2017 [[Link]] Peer Connection Initiated with


[AF_INET][Link]:25000

Fri Nov 24 07:32:09 2017 MANAGEMENT: >STATE:1511483529,GET_CONFIG,,,,,,

Fri Nov 24 07:32:09 2017 SENT CONTROL [[Link]]: 'PUSH_REQUEST' (status=1)

Fri Nov 24 07:32:09 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway


def1,dhcp-option DNS [Link],dhcp-option DNS [Link],route [Link],topology net30,ping 5,ping-
restart 30,ifconfig [Link] [Link]'
Fri Nov 24 07:32:09 2017 OPTIONS IMPORT: timers and/or timeouts modified

Fri Nov 24 07:32:09 2017 OPTIONS IMPORT: --ifconfig/up options modified

Fri Nov 24 07:32:09 2017 OPTIONS IMPORT: route options modified

Fri Nov 24 07:32:09 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified

Fri Nov 24 07:32:10 2017 Outgoing Data Channel: Cipher 'BF-CBC' initialized with 128 bit key

Fri Nov 24 07:32:10 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This
allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).

Fri Nov 24 07:32:10 2017 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC
authentication

Fri Nov 24 07:32:10 2017 Incoming Data Channel: Cipher 'BF-CBC' initialized with 128 bit key

Fri Nov 24 07:32:10 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This
allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).

Fri Nov 24 07:32:10 2017 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC
authentication

Fri Nov 24 07:32:10 2017 WARNING: cipher with small block size in use, reducing reneg-bytes to
64MB to mitigate SWEET32 attacks.

Fri Nov 24 07:32:10 2017 interactive service msg_channel=668

Fri Nov 24 07:32:10 2017 ROUTE_GATEWAY [Link]/[Link] I=5


HWADDR=30:10:b3:5a:19:01

Fri Nov 24 07:32:10 2017 open_tun

Fri Nov 24 07:32:10 2017 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{FC51ED28-35A6-4594-


94D4-2F2FE697C6E5}.tap

Fri Nov 24 07:32:10 2017 TAP-Windows Driver Version 9.21

Fri Nov 24 07:32:10 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of
[Link]/[Link] on interface {FC51ED28-35A6-4594-94D4-2F2FE697C6E5} [DHCP-serv:
[Link], lease-time: 31536000]

Fri Nov 24 07:32:10 2017 Successful ARP Flush on interface [22] {FC51ED28-35A6-4594-94D4-
2F2FE697C6E5}

Fri Nov 24 07:32:10 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0

Fri Nov 24 07:32:10 2017 MANAGEMENT: >STATE:1511483530,ASSIGN_IP,,[Link],,,,

Fri Nov 24 07:32:15 2017 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up

Fri Nov 24 07:32:15 2017 C:\Windows\system32\[Link] ADD [Link] MASK


[Link] [Link]

Fri Nov 24 07:32:15 2017 Route addition via service succeeded

Fri Nov 24 07:32:15 2017 C:\Windows\system32\[Link] ADD [Link] MASK [Link] [Link]
Fri Nov 24 07:32:15 2017 Route addition via service succeeded

Fri Nov 24 07:32:15 2017 C:\Windows\system32\[Link] ADD [Link] MASK [Link]


[Link]

Fri Nov 24 07:32:15 2017 Route addition via service succeeded

Fri Nov 24 07:32:15 2017 MANAGEMENT: >STATE:1511483535,ADD_ROUTES,,,,,,

Fri Nov 24 07:32:15 2017 C:\Windows\system32\[Link] ADD [Link] MASK [Link]


[Link]

Fri Nov 24 07:32:15 2017 Route addition via service succeeded

Fri Nov 24 07:32:15 2017 Initialization Sequence Completed

Fri Nov 24 07:32:15 2017 MANAGEMENT:


>STATE:1511483535,CONNECTED,SUCCESS,[Link],[Link],25000,,

Fri Nov 24 08:25:18 2017 C:\Windows\system32\[Link] DELETE [Link] MASK [Link]


[Link]

Fri Nov 24 08:25:18 2017 Route deletion via service succeeded

Fri Nov 24 08:25:18 2017 C:\Windows\system32\[Link] DELETE [Link] MASK


[Link] [Link]

Fri Nov 24 08:25:18 2017 Route deletion via service succeeded

Fri Nov 24 08:25:18 2017 C:\Windows\system32\[Link] DELETE [Link] MASK [Link]


[Link]

Fri Nov 24 08:25:18 2017 Route deletion via service succeeded

Fri Nov 24 08:25:18 2017 C:\Windows\system32\[Link] DELETE [Link] MASK [Link]


[Link]

Fri Nov 24 08:25:18 2017 Route deletion via service succeeded

Fri Nov 24 08:25:18 2017 Closing TUN/TAP interface

Fri Nov 24 08:25:18 2017 TAP: DHCP address released

Fri Nov 24 08:25:18 2017 SIGTERM[hard,] received, process exiting

Fri Nov 24 08:25:18 2017 MANAGEMENT: >STATE:1511486718,EXITING,SIGTERM,,,,,

You might also like