crackthe.net
Guides: VPN, private email, and the defender's handbook
Learn how VPNs work and how to choose one, in five levels from the basics to measurement evidence, plus private email and a handbook of tables for defenders.
Start at level 0 if a VPN is new to you, or jump to the level that fits your question. Each guide is short, explains every term it uses, and links to the page where you can check the figures yourself.
VPN
Level 0: Basics
What a VPN is, what it does, and whether you need one.
4 min readWhat is a VPN? Meaning, how it works, and what it hidesVPN meaning in plain words: what a VPN is, how it works, what it hides and what it does not, with a diagram and the archive's own figures.
3 min readWhat is an IP address? What websites can see about youWhat an IP address is, what a website can learn from it, how a VPN changes it, and why the country shown is not always where the server is.
3 min readDo you need a VPN? Advantages and disadvantagesWhen a VPN helps, when it does not, and what it costs you in trust, speed, and money. A decision guide with the archive's figures.
3 min readIs it legal to use a VPN?Where using a VPN is legal, which countries restrict it, why legal does not mean allowed by every service, and what stays illegal with a VPN. With sources.
3 min readIs a free VPN safe? Free plans, trials, and refundsWhat a free VPN plan, a free trial, and a money-back guarantee give you, which providers here name a free plan, and how to judge a free VPN app.
3 min readVPN vs proxy: what is the difference?What a proxy and a VPN have in common, how they differ in encryption and in the apps they cover, which one fits which job, and how to check the result yourself.Level 1: First steps
Choose a VPN, set it up, and check that it works.
3 min readHow to choose your first VPN: 7 points to check before buyingSeven points to check before you buy a VPN, from countries and the price after the first term to company seat and trackers, each linked to our data.
2 min readHow to use a VPN: set it up and connect, step by stepHow to use a VPN, from choosing a plan to your first connection: setting up the app, picking a location, connecting, and checking that it works.
3 min readIs my VPN working? Three quick checksThree simple checks to see whether your VPN hides your IP address, shows the country you picked, and does not leak, using the tools on this site.
2 min readHow much does a VPN cost per month? Prices explainedWhy VPN prices differ so much, what initial term and renewal price mean, and what the providers here charge per month, from their own pricing pages.
3 min readShould your VPN be on all the time?When to keep your VPN on, when you can turn it off, and how split tunneling helps with banks and streaming apps that block VPN addresses.
4 min readVPN apps for iPhone, Android, PC, Mac, TV, and routerWhich VPN providers offer apps for iPhone, Android, Windows, Mac, browsers, TV, and routers, how the apps differ, and which free plans run on which device.Level 2: Know your provider
Who runs a VPN, what it tracks, and what its figures mean.
3 min readWhat is a virtual VPN location? When the server is elsewhereWhat a virtual VPN location is, how many there are, which providers mark them, and what latency measurements show for marked and unmarked locations.
3 min readWho owns your VPN? Owners, company seats, and the Five EyesWhy the company behind a VPN matters, which providers in this archive share an owner, where they are based, and what the Five, Nine, and Fourteen Eyes are.
2 min readWhat VPN websites track before you buyWhich advertising and analytics services VPN provider home pages load on a first visit, why it matters for a privacy product, and how this archive checks it.
3 min readHow to read a VPN review on this siteA walk through a provider page: key figures, points for and against, prices, who is behind it, the website check, and the measured location table.
3 min readVPN features explained: kill switch, split tunneling, multi-hopWhat a kill switch, split tunneling, multi-hop, and a dedicated (static) IP do, which features you need as a beginner, and which providers name them.Level 3: How it works
Protocols, encryption, leaks, and geoblocking, explained simply.
3 min readVPN protocols: WireGuard, OpenVPN, and what they changeWhat a VPN protocol is, how WireGuard, OpenVPN, and IKEv2 differ, whether TCP or UDP is better, and why you should avoid PPTP.
3 min readVPN tunnel and encryption: what is protected and what is notWhich part of your connection a VPN encrypts, what HTTPS protects on top of that, and what the VPN provider and the networks behind its servers can still see.
3 min readDNS and WebRTC leaks: when your real address slips outWhat DNS leaks, WebRTC leaks, and IPv6 leaks are, why they can reveal you while the VPN is on, and what you can check and change yourself.
3 min readGeoblocking explained: why websites answer differently by countryHow websites decide which country you are in, why they block or change content by country, what a VPN changes, and how to test a site from many countries.
2 min readThe networks behind VPN serversMost VPN providers rent servers in other companies' data centers. Which networks carry them, how many providers share them, and what that means for you.Level 4: Expert
How measurements locate servers, and how to read the evidence.
3 min readHow latency reveals where a VPN server really isWhy a fast reply proves a server is near, how ping times become distance limits, and the rules that decide whether a location matches its country.
3 min readReading measurement evidence: probes, limits, and open resultsHow to read the evidence table behind a location's status: probes, networks, fastest reply, distance limits, discarded probes, and why many results stay open.
2 min readVPN server lists as data: what providers publishWhat a VPN server list contains, how lists differ, why stated server counts and listed locations do not match, and how this archive records each change.
2 min readThe real cost of a VPN over three yearsWhat a VPN costs over 36 months when the cheap initial term ends: a calculation from each provider's own stated prices, with the assumptions explained.
3 min readAudits and no-logs claims: what they can and cannot proveWhat a no-logs policy promises, what an outside audit checks, its limits, and which audits the providers in this archive describe on their own websites.Private email
Defender's handbook
Reference tables for watching industrial and office networks.
Ports and protocols
Many industrial protocols were designed without encryption or login. The secured variants came later, often on a port of their own.
| Protocol | Port | Used for | Secured variant |
|---|---|---|---|
| Modbus/TCP | TCP 502 | Industrial automation in every sector: controllers (PLCs), remote units, sensors, energy meters | Modbus/TCP Security: TLS with certificates and roles (TCP 802) |
| DNP3 | TCP 20000 | Control systems of power utilities, also water, oil and gas; dominant in North America | Secure Authentication (SAv5); DNP3 over TLS (19999) |
| IEC 60870-5-104 | TCP 2404 | Remote control of power grids, mainly outside North America | TLS (IEC 62351-3) plus authentication (IEC 62351-5) (TCP 19998) |
| ICCP (TASE.2) | TCP 102 | Data exchange between the control centers of grid operators | Secure ICCP: ICCP through TLS (TCP 3782) |
| S7comm (ISO-TSAP) | TCP 102 | Siemens S7 controllers: programming, HMI, data exchange; the same port carries MMS (IEC 61850, ICCP) | TLS for S7-1200 and S7-1500, the default since TIA Portal V17; classic S7comm has none |
| EtherNet/IP, CIP | TCP 44818, UDP 2222 | Factory automation: 44818 for messages, 2222 for cyclic I/O | CIP Security (TLS and DTLS) (2221) |
| PROFINET | Layer 2 (EtherType 0x8892); UDP 34962–34964 | Factory automation: real-time I/O and device naming (DCP) run directly on Ethernet; UDP 34964 sets up connections | Security classes 1 to 3 (34965, 34966) |
| OPC UA | TCP 4840 | Vendor-neutral data exchange, the successor to OPC Classic; UDP 4840 for publish-subscribe | Built in: security modes None, Sign and SignAndEncrypt (4843) |
| OPC DA (OPC Classic) | TCP 135, then a port from 49152–65535 | Older Windows-based OPC over DCOM | None in the protocol; Windows has enforced stricter DCOM authentication since March 14, 2023 |
| BACnet/IP | UDP 47808 | Building automation: heating, ventilation, lighting, access control | BACnet Secure Connect: TLS over WebSockets |
| Protocol | Port | Used for | Secured variant |
|---|---|---|---|
| SMB | TCP 445 | Windows file and printer sharing | SMB 3 encryption and signing; SMB over QUIC with TLS 1.3 (UDP 443) |
| NetBIOS | UDP 137, 138, TCP 139 | Older Windows name resolution and SMB1; SMB2 and later do not use these ports | None |
| LLMNR | UDP 5355 | Windows name lookup when DNS fails; attackers answer it with forged replies to collect logins | None |
| mDNS | UDP 5353 | Name lookup in the .local domain: printers, IoT devices, Apple Bonjour | None |
| DNS | UDP, TCP 53 | Name resolution; TCP for large answers and zone transfers | DNS over TLS and over QUIC (853), over HTTPS (443); DNSSEC signs but does not encrypt |
| DHCP | UDP 67, 68 | Automatic IPv4 addresses; DHCPv6 uses UDP 546 and 547 | None in common use |
| SNMP | UDP 161, 162 | Monitoring network devices: 161 for queries, 162 for traps | SNMPv3 with authentication and encryption, or SNMP over TLS and DTLS; versions 1 and 2c send the community string in cleartext (10161, 10162) |
| Syslog | UDP 514 | Log messages; TCP 514 is registered to rsh, not to syslog | Syslog over TLS (TCP 6514) |
| FTP | TCP 21, 20 | File transfer in cleartext: 21 for commands, 20 for data in active mode | FTPS (TLS); SFTP is a separate protocol inside SSH (990, TCP 22) |
| Telnet | TCP 23 | Remote console in cleartext, passwords included | SSH (TCP 22) |
| LLDP, CDP | Layer 2 | Neighbor discovery between switches and devices, with names, software versions and VLANs; PROFINET uses LLDP for its topology | None |
| ARP | Layer 2 (EtherType 0x0806) | Finds the MAC address for an IPv4 address on the local network | None: replies are not authenticated |
| ICMP | IP protocol 1 (ICMPv6: 58) | Ping and error messages; in IPv6 also neighbor discovery | None |
Wireshark display filters
Type these into Wireshark's filter bar to narrow a capture down to one protocol or to signs of trouble. The field names are checked against the Wireshark display filter reference.
| Filter | Shows |
|---|---|
modbus || mbtcp | All Modbus/TCP traffic: the header (mbtcp) and the command (modbus) |
modbus.func_code in {5,6,15,16,23} | Modbus commands that write coils or registers |
modbus.exception_code | Modbus error responses; only they carry this field |
mbtcp.unit_id == 1 | Modbus traffic to one device behind a gateway (unit 1) |
s7comm | Siemens S7 communication, built in since Wireshark 2.0 |
dnp3 | DNP3 |
iec60870_104 || iec60870_asdu | IEC 60870-5-104; up to Wireshark 3.0 the filter was 104apci |
enip || cip | EtherNet/IP and CIP |
bacnet || bvlc || bacapp | BACnet/IP: link, network and application layer |
cdp || lldp | Neighbor discovery, which gives away device names, software versions and VLANs |
llmnr || nbns || mdns | Broadcast name lookups that attackers can answer with forged replies |
tcp.flags.syn == 1 && tcp.flags.ack == 0 | Connection attempts; many to different ports or hosts suggest a scan |
tcp.port in {102,502,2404,20000,44818} | The usual TCP ports of industrial protocols at a glance |
frame matches "password" | Packets that contain the word password in any case, such as logins over Telnet or FTP |
tcp.port != 502 | Everything except Modbus/TCP: since Wireshark 3.6, != means that no port equals 502, the same as !(tcp.port == 502) |
These are display filters. Capture filters decide what is recorded at all. They use a different syntax, such as tcp port 502. contains looks for text and is case-sensitive; matches takes a regular expression and ignores case by default.
Modbus/TCP
Modbus has no login and no encryption: anyone who can reach port 502 can read and write. A request over TCP is a 7-byte header followed by the command.
Transaction Identifier2 bytes
Protocol Identifier2 bytes
Length2 bytes
Unit Identifier1 byte
Function code1 byte
Datavariable
MBAP headerPDU
| Field | Bytes | Meaning | Wireshark field |
|---|---|---|---|
| Transaction Identifier | 2 | Pairs request and response: the client sets it, the server copies it | mbtcp.trans_id |
| Protocol Identifier | 2 | 0 for Modbus; frames with another value are discarded | mbtcp.prot_id |
| Length | 2 | Number of bytes that follow: unit identifier plus PDU | mbtcp.len |
| Unit Identifier | 1 | The device behind a gateway (1 to 247); 0xFF or 0 for a device reached directly | mbtcp.unit_id |
| Function code | 1 | What the request does (table below) | modbus.func_code |
| Data | ≤ 252 | Start address, count, values: up to 252 bytes | modbus.data |
| Code | Hex | Name | Purpose |
|---|---|---|---|
| 1 | 0x01 | Read Coils | reads |
| 2 | 0x02 | Read Discrete Inputs | reads |
| 3 | 0x03 | Read Holding Registers | reads |
| 4 | 0x04 | Read Input Registers | reads |
| 5 | 0x05 | Write Single Coil | writes |
| 6 | 0x06 | Write Single Register | writes |
| 8 | 0x08 | Diagnostics | diagnostics, mostly on serial lines |
| 15 | 0x0F | Write Multiple Coils | writes |
| 16 | 0x10 | Write Multiple Registers | writes |
| 23 | 0x17 | Read/Write Multiple Registers | reads and writes |
| 43 | 0x2B | Encapsulated Interface Transport (MEI 14: Read Device Identification) | device information |
| 65–72, 100–110 | 0x41–0x48, 0x64–0x6E | User-defined | defined by the vendor, not unique |
| 90 | 0x5A | Schneider Electric UMAS (decoded by Wireshark) | programs Schneider controllers |
| Code | Name | Meaning |
|---|---|---|
01 | Illegal Function | The device does not support this function code |
02 | Illegal Data Address | The address does not exist on the device |
03 | Illegal Data Value | A value in the request is not allowed |
04 | Server Device Failure | The device failed while carrying out the request |
05 | Acknowledge | Accepted; a long programming command is still running |
06 | Server Device Busy | The device is busy with a long command |
08 | Memory Parity Error | Memory error while reading a file record (functions 20 and 21) |
0A | Gateway Path Unavailable | The gateway has no path to the target device |
0B | Gateway Target Device Failed to Respond | The device behind the gateway did not answer |
An error response repeats the function code plus 0x80 (0x03 becomes 0x83) and carries one of these codes. Code 07 (Negative Acknowledge) is an old Modicon code that the current specification no longer lists.
| Sign | Filter | Why it matters |
|---|---|---|
| Write commands from an unexpected host | modbus.func_code in {5,6,15,16,23} | Writes change the process. In normal operation only a few known systems send them, such as the HMI or the engineering station. |
| Many error responses | modbus.exception_code | Requests for functions or addresses a device does not have: typical of a scan or a misconfigured client. |
| Device identification | modbus.func_code == 43 | Returns vendor, product and version: useful for an inventory, and for an attacker. |
| Schneider programming traffic | modbus.func_code == 90 | UMAS programs Schneider controllers; it should come only from the engineering station. |
| Protocol identifier other than 0 | mbtcp.prot_id != 0 | Not Modbus: another protocol on port 502, or crafted packets. |
| Unit identifier 0 | mbtcp.unit_id == 0 | Behind a gateway, 0 is a broadcast: a write reaches every serial device, and none answers. |
| User-defined function codes | modbus.func_code >= 65 && modbus.func_code <= 72 | Vendor-specific, so two vendors may use the same code for different things. The second range is 100 to 110. |