VPN leak test

[eltavlador 0]

I read this post about doing a VPN leak test and noticed that tcpdump reports traffic to/from an IP that is a number less than my VPN IP address. For example my current address is 213.152.162.165 but tcpdump reports 213.152.162.164:

 

sudo tcpdump -n -i 1 not host 213.152.162.165 2>&1 | tee tcpdump.log

 

11:17:44.277413 IP 192.168.1.2.42576 > 213.152.162.164.443: UDP, length 117
11:17:44.325177 IP 213.152.162.164.443 > 192.168.1.2.42576: UDP, length 165

Is this normal and if yes why the difference?

 

[me.moo@posteo.me 80]

213.152.162.164 is the IP Entry address of the Air server you are connected to whereas 213.152.162.165 is the IP Exit address of that server, the one the world see's.

[User of AirVPN 47]

The IP ending in 164 that is one lower is the entry IP address, the IP which you connect to.

The one ending in 165 is the exit IP, which everyone else sees.

This prevents correlation attacks.

[me.moo@posteo.me 80]

The IP ending in 164 that is one lower is the entry IP address, the IP which you connect to.

The one ending in 165 is the exit IP, which everyone else sees.

This prevents correlation attacks.

 

Why the repeat?