drop openvpn server log + status file · parse client connect + bytes + cipher · runs locally
drop openvpn server log + status file · local only
heuristic screener · vendor schema varies · not definitive proof