Member Avatar for imtrble

Hi all -

This is going to seem like an odd post since it's not too technical in nature, but I'm hoping you can help set my mind at ease or confirm my high level of anxiety.

I was on my home computer using Yahoo Messenger and chatting with a work friend. Said work friend was logged into his VPN but didn't realize it. He was not remoted into his work machine or anything and was on his home computer, but was definitely logged into VPN. Well, a large portion of that conversation is something that we are hoping was not read/caught/monitored by our company.

How likely is it that they monitor something like that? And how easy would it be to "see" the conversation? Would they be able to tell who I am since I was not logged in but was on my own home network (and behind a firewall)?

Please - no flaming. I am well aware that I could lose my job if any of this was monitored and am really freaking out over it all. I'm hoping you can justify my anxiety or help ease it.

Thanks in advance and I apologize for posting something so trivial in your forum. I didn't know where else to turn for answers!

  • 2 Contributors
  • 3 Replies
  • 121 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by sknake

Dani AI

Generated

As described, the key fact is that the VPN client changed the machine's default route; as pointed out, that is the difference between a "split‑tunnel" and a "full‑tunnel" setup. When the corporate VPN becomes the system default route, outbound connections leave the laptop inside the company perimeter and can be subject to whatever logging and inspection the company runs at the VPN concentrator, firewall/proxy, or IDS/DPI appliances.

What those systems can record is largely factual: the VPN gateway keeps an authentication-to-IP mapping, perimeter devices log timestamps, source (the VPN‑assigned address), destination IPs/ports and protocol, and proxies can capture HTTP/IM payloads if they are not end‑to‑end encrypted. Some enterprises also run TLS/SSL interceptors (with a trusted certificate installed on the client) that can decrypt and inspect SSL/TLS flows. Whether the other party’s home IP was visible depends on the IM architecture — server‑relayed chat usually limits exposure to the IM provider’s servers; P2P components (file transfer, voice) can expose peer IPs.

Useful, non-invasive checks that follow from the above: inspect the VPN client’s connection properties (look for settings described as "send all traffic" or "use remote gateway"), review the VPN client or system connection log for the internal IP assigned and the connection timestamp, and examine the IM client’s connection/transport settings to see whether it uses encrypted sessions or direct peer connections. If corporate logs are required to prove anything, the VPN/gateway logs are where the mapping back to an employee account would be recorded.

A practical note: routine mass reassembly of every IM conversation is uncommon because it’s resource‑intensive and raises legal/privacy issues; investigations are normally triggered by policy violations or suspicion. Altering or deleting logs is a serious mistake. For future privacy, keep personal chats off machines while connected to corporate VPNs or use personal devices/networks when confidentiality is important.

Recommended Answers

All 3 Replies

Member Avatar for sknake

It depends how the VPN is configured and what clients you use.

Say your home IP is and you VPN in to work and their network space is and the VPN client adds a route to your routing table just for the VPN address space. In this case you are OK.

However some VPN clients force all traffic through the VPN connection that way corporate can monitor all network traffic.

Given the fact that it adds significant overhead to the corporate office to force all VPN traffic through the home office -- they usually install this set up if they want to monitor traffic. I would say that it is likely the conversation was logged however I personally don't review audit logs unless someone asks me too. I'm not pro-active about sniffing conversations but I am re-active when an employee is suspected of doing something detrimental to the business.

Check out how your VPN works :)

Member Avatar for imtrble

Thank you so much for your response. I just did a route print from a command line before and after being connected and it looks like the default gateway changed from my home IP to what is likely a work IP address. There are also a few other network destinations logged. Does that mean anything? Or would I need to know some more about how our VPN works?

If the conversation is logged, can they tell who the person is that wasn't logged in via VPN or will they just get an external IP address.

As a side note - nothing said was detrimental to the business - just personal. :-)

Member Avatar for sknake

just do a tracert [url]www.yahoo.com[/url] or whatever messenger you were using. If you see the traffic hops on to your VPN's address space then you know you're in trouble. If it goes out your DSL router's IP address then you're OK.

I don't think most businesses specifically log IM traffic, reassemble the conversations, dissect them, analyze and report on them. It is a lot of overhead to do day-in-day-out unless you have a strict no tolerance policy where they will terminate you on the spot. I wouldn't worry about it too much and be sure not to ask questions or raise suspicion. If they know -- then there is nothing you can do. If they don't know then you will only tip them off that you're nervous about something that happened and they will look at the logs if they have any.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.