How to packet trace a VPN

Question

After installing a VPN I tried to see if outbound traffic was actually encrypted.
When the VPN is activated, ifconfig shows a new interface "tun0:" so I ran a packet trace against tun0. The trace was started with...
sudo tcpdump -i tun0 -s 0 -w VPNActivetun0.dmp
...and then Mail was started. Once mail had connected to the mail servers the trace was stopped and then formatted with...
tcpdump -s 0 -n -e -X -r VPNActivetun0.dmp
...and it contains lots of clear text including email account passwords being transmitted.
What am I doing wrong ?

Answer 1

I've also see that I'm tracing gobs and gobs of non-Internet packets, to and from 10.?.?.?. Do you know how I can filter these out?
Presumably your local network is 10.x.x.x, otherwise you shouldn't see these at all.
However, that said, if your local network is 10.x.x.x then you cannot tell tcpdump to blindly ignore anything to/from 10.x.x.x because that will include the very traffic you're trying to trace.
The best solution is to tell tcpdump specifically which traffic you DO want to see, either via IP address or port number.
For example, if you're trying to see what (if any) SMTP traffic (port 25) is going to/from your machine:
<pre class=command>sudo tcpdump -i en1 port 25</pre>
To see traffic going to/from a specific IP address:
<pre class=command>sudo tcpdump -i en1 host 1.2.3.4</pre>
You can also use the keywords and and not to further refine what traffic to look for. e.g. to watch all non-http traffic going to 1.2.3.4:
<pre class=command>sudo tcpdump -i en1 host 1.2.3.4 and not port 80</pre>