The problem
Your VPN client shows a green "Connected" toggle. That's a marketing claim, not a proof. A tunnel can be up while DNS leaks, IPv6 bypasses the route, or your "anonymous" egress sits in a datacenter that any service can fingerprint.
How ActiveVPN works
The scan collects five groups of signals:
- Network interfaces — checks psutil.net_if_addrs() against patterns like tun, tap, utun, wg, ipsec, tailscale, zerotier.
- Processes — iterates running processes and matches them against known VPN/Tor binaries using exact/CLI-token matching (this removed a lot of naive-substring false positives, e.g. "vpn" matching random apps).
- External IP — queries ip-api.com, ipinfo.io, and ipapi.co in a failover chain for IP, ISP, country, hosting, and proxy flags.
- DNS — calls edns.ip-api.com to find the resolver IP your DNS queries actually go through.
- IPv4/IPv6 — fetches both via ipify to spot IPv6 leaks around an IPv4-only tunnel.
Verdict scoring
Each signal has a weight (interface 50, VPN process 40, Tor 35, hosting 25, proxy 30). The sum, capped at 100, maps to:
- 0-19 CLEAN
- 20-39 SUSPICIOUS
- 40-74 LIKELY VPN/PROXY
- 75-100 VPN DETECTED
Extras worth mentioning
- Kill switch: sudo activevpn --kill / --kill-force.
- Watch mode: activevpn --watch 30 with on_change callbacks for VPN-drop alerts.
- History & export: JSON/CSV/TXT from the platform data directory.
- Exit codes (0/1/2) so you can wire it into CI.
- Library API: import activevpn; result = activevpn.scan(); result.verdict.label.
- Docker image + GitHub Pages docs + full pytest suite running on 3 OSes across Python 3.8 and 3.12.
Install
pip install activevpn
activevpn
GitHub: https://github.com/rkriad585/ActiveVPN
Docs: https://rkriad585.github.io/ActiveVPN
