How can you detect IPsec VPN traffic in a capture?

• A. Filter by ip.proto == 50 for ESP, ip.proto == 51 for AH, and look for IKE negotiation messages on UDP 500/4500.
• B. Filter by port 80 and look for HTTP GET requests.
• C. Look for DNS responses on port 53 only.
• D. Use ARP requests to identify VPN endpoints.

Answer: (A)

IPsec VPN traffic shows up at the IP layer with specific protocol numbers and, for the negotiation phase, on common UDP ports. ESP and AH are dedicated IPsec protocols: ESP uses protocol number 50 and AH uses protocol number 51. If you filter by these protocol numbers, you’ll see IPsec traffic regardless of the actual encapsulated data. In addition, the IKE negotiation that establishes IPsec SAs uses ISAKMP over UDP ports 500, and when NAT traversal is involved, UDP port 4500 carries IPsec traffic.

So, filtering for ip.proto == 50 (ESP) or ip.proto == 51 (AH) and looking for IKE negotiation messages on UDP 500/4500 is the right way to detect IPsec VPN traffic in a capture. The other options don’t fit because they focus on HTTP, DNS, or ARP, which are unrelated to IPsec VPN traffic.