Packet capture
Wireshark / TShark
Record DNS, TLS, tunnel, retransmission, and route-transition traffic in pcapng so another reviewer can inspect the same packets.
When to use it
Before, during, and after connect, disconnect, reconnect, server switch, sleep/wake, and network changes.
tshark -i 1 -f "port 53 or port 443" -w vpn-transition.pcapng
- DNS packets leaving outside the expected tunnel
- Unprotected traffic during route transitions
- Repeated TLS failures or unexpected endpoints
- Capture timestamp aligned with the test-case log
Official TShark manualDNS path
dig + OS resolver inspection
Compare the operating system’s configured resolvers with packet-level observations instead of trusting a web page alone.
When to use it
Connected, disconnected, after a network switch, and after the VPN process is terminated abnormally.
dig example.com A
# Linux: resolvectl status
# macOS: scutil --dns
- Which resolver addresses are configured
- Which interface sends DNS traffic
- Whether IPv4 and IPv6 resolver paths differ
- Whether old resolvers remain after reconnect
BIND 9 official manual pagesRoutes and interfaces
iproute2 / route / netstat
Verify that the operating system’s real default route, policy routes, and tunnel interface agree with the VPN interface status.
When to use it
At every connection state transition and for both full-tunnel and split-tunnel modes.
# Linux
ip -details route show table all
ip address show
# macOS
route -n get default
netstat -rn
- Default route points to the intended tunnel path
- No stale bypass route after failure
- Split-tunnel exclusions are limited to declared targets
- IPv6 has an explicit protected or disabled path
Linux ip-route manualTLS and API behavior
OpenSSL s_client + curl
Inspect the certificate chain, SNI behavior, protocol negotiation, response headers, and safe failure of authorized test APIs.
When to use it
Checking production TLS configuration and a staging API’s behavior with missing, invalid, expired, or logged-out test sessions.
openssl s_client -connect vpn.example:443 -servername vpn.example </dev/null
curl -i -H "Authorization: Bearer INVALID_TEST_TOKEN" https://staging.example/api/config
- Hostname and certificate-chain validation
- Negotiated TLS version and cipher
- Invalid sessions receive a consistent denial
- Error responses do not disclose internal configuration or secrets
OpenSSL official documentationIdentify listening services and reported versions on a controlled laboratory host or explicitly in-scope server.
When to use it
Building an asset inventory and confirming that a remediated service is no longer exposed.
nmap -sV --version-light 192.0.2.10
- Open, closed, and filtered ports
- Unexpected services
- Reported service versions that need manual confirmation
- Difference between pre-fix and retest inventories
Official Nmap reference guideRecord and review browser/API requests, session behavior, parameters, and passive findings for an authorized dashboard.
When to use it
Testing login, logout, token invalidation, account boundaries, CSRF controls, and error handling in a dedicated test environment.
1. Add only the staging host to a ZAP Context.
2. Select Protected mode.
3. Launch a browser through ZAP.
4. Explore with test accounts; review History and passive Alerts.
5. Run active tests only when the exact target is authorized.
- Token use before and after logout
- Cross-account object identifiers
- Sensitive values in requests or responses
- Security headers and passive alerts
- No out-of-scope host in the Sites tree
Official ZAP modes documentation