Best VPN for Antivirus vs ExpressVPN: What You Need to Know

#!/usr/bin/env python3
"""VPN Throughput Benchmark Script
Benchmarks download/upload speed and latency for a target VPN provider.
Methodology: Runs speedtest-cli 5 times (configurable) per test, averages results.
Hardware: MacBook Pro M2 Max, 32GB RAM, 1Gbps fiber (Comcast Business)
OS: macOS Sonoma 14.5
Python: 3.12.4
speedtest-cli: 2.1.4
"""

import argparse
import json
import time
import sys
import os
import subprocess
from typing import Dict, List, Optional

def check_dependencies() -> bool:
    """Verify speedtest-cli is installed, exit if not."""
    try:
        subprocess.run(["speedtest-cli", "--version"], capture_output=True, check=True)
        return True
    except FileNotFoundError:
        print("ERROR: speedtest-cli not installed. Install via: pip install speedtest-cli", file=sys.stderr)
        return False
    except subprocess.CalledProcessError as e:
        print(f"ERROR: speedtest-cli check failed: {e}", file=sys.stderr)
        return False

def run_single_speed_test() -> Optional[Dict]:
    """Run a single speedtest-cli test, return parsed results or None on failure."""
    try:
        result = subprocess.run(
            ["speedtest-cli", "--json", "--secure"],
            capture_output=True,
            text=True,
            timeout=60
        )
        if result.returncode != 0:
            print(f"WARNING: Speed test failed with return code {result.returncode}: {result.stderr}", file=sys.stderr)
            return None
        return json.loads(result.stdout)
    except subprocess.TimeoutExpired:
        print("WARNING: Speed test timed out after 60 seconds", file=sys.stderr)
        return None
    except json.JSONDecodeError as e:
        print(f"WARNING: Failed to parse speedtest output: {e}", file=sys.stderr)
        return None

def aggregate_results(results: List[Dict]) -> Dict:
    """Average speed test results across multiple runs."""
    valid_results = [r for r in results if r is not None]
    if not valid_results:
        return {"download_mbps": 0, "upload_mbps": 0, "latency_ms": 0, "test_count": 0}

    total_down = sum(r["download"] / 1_000_000 for r in valid_results)  # convert bps to Mbps
    total_up = sum(r["upload"] / 1_000_000 for r in valid_results)
    total_lat = sum(r["ping"] for r in valid_results)

    return {
        "download_mbps": round(total_down / len(valid_results), 2),
        "upload_mbps": round(total_up / len(valid_results), 2),
        "latency_ms": round(total_lat / len(valid_results), 2),
        "test_count": len(valid_results)
    }

def main():
    parser = argparse.ArgumentParser(description="Benchmark VPN throughput")
    parser.add_argument("--vpn-name", required=True, help="Name of VPN being tested (e.g., ExpressVPN, Norton-VPN)")
    parser.add_argument("--iterations", type=int, default=5, help="Number of speed tests to run (default: 5)")
    parser.add_argument("--output", default="benchmark_results.json", help="Output file for results (default: benchmark_results.json)")
    args = parser.parse_args()

    if not check_dependencies():
        sys.exit(1)

    print(f"Starting {args.iterations} speed tests for {args.vpn_name}...")
    results = []
    for i in range(args.iterations):
        print(f"Running test {i+1}/{args.iterations}...")
        test_result = run_single_speed_test()
        results.append(test_result)
        time.sleep(2)  # cooldown between tests

    aggregated = aggregate_results(results)
    aggregated["vpn_name"] = args.vpn_name
    aggregated["timestamp"] = time.time()
    aggregated["iterations_requested"] = args.iterations

    with open(args.output, "w") as f:
        json.dump(aggregated, f, indent=2)

    print(f"Results for {args.vpn_name}:")
    print(f"  Download: {aggregated['download_mbps']} Mbps")
    print(f"  Upload: {aggregated['upload_mbps']} Mbps")
    print(f"  Latency: {aggregated['latency_ms']} ms")
    print(f"  Valid tests: {aggregated['test_count']}/{args.iterations}")
    print(f"Results saved to {args.output}")

if __name__ == "__main__":
    main()

#!/usr/bin/env node
/**
 * DNS Leak Detection Script for VPN Validation
 * Checks if DNS requests are routed through ISP or VPN provider when connected to VPN.
 * Methodology: Sends DNS queries to 5 public resolvers, logs source IP of each response.
 * Hardware: Dell XPS 15 9530, 16GB RAM, 500Mbps cable (Spectrum)
 * OS: Ubuntu 24.04 LTS
 * Node.js: v20.12.2
 * axios: v1.7.2
 */

const axios = require('axios');
const { promisify } = require('util');
const dns = require('dns');
const dnsResolve = promisify(dns.resolve);

// Public DNS leak test endpoints (return client IP as JSON)
const LEAK_TEST_ENDPOINTS = [
    'https://dnsleaktest.com/api/json/ip',
    'https://ipinfo.io/json',
    'https://api.ipify.org?format=json',
    'https://icanhazip.com',
    'https://checkip.amazonaws.com'
];

// Known VPN provider DNS server IP ranges (simplified for demo)
const VPN_DNS_RANGES = {
    'ExpressVPN': ['103.2.12.0/24', '198.44.128.0/24'],  // Lightway DNS servers
    'Norton-VPN': ['199.85.124.0/24', '199.85.127.0/24']   // Norton VPN DNS servers
};

/**
 * Check if an IP address falls within a given CIDR range
 * @param {string} ip - IPv4 address to check
 * @param {string} cidr - CIDR range (e.g., 103.2.12.0/24)
 * @returns {boolean} True if IP is in range
 */
function isIpInCidr(ip, cidr) {
    try {
        const [rangeIp, prefixLength] = cidr.split('/');
        const ipParts = ip.split('.').map(Number);
        const rangeParts = rangeIp.split('.').map(Number);
        const mask = ~(0xFFFFFFFF >>> parseInt(prefixLength, 10)) >>> 0;

        const ipInt = (ipParts[0] << 24) | (ipParts[1] << 16) | (ipParts[2] << 8) | ipParts[3];
        const rangeInt = (rangeParts[0] << 24) | (rangeParts[1] << 16) | (rangeParts[2] << 8) | rangeParts[3];

        return (ipInt & mask) === (rangeInt & mask);
    } catch (e) {
        console.error(`ERROR: Failed to check CIDR range: ${e.message}`);
        return false;
    }
}

/**
 * Fetch client IP from a single endpoint
 * @param {string} url - Endpoint URL
 * @returns {Promise} Client IP or null on failure
 */
async function fetchClientIp(url) {
    try {
        const response = await axios.get(url, { timeout: 5000 });
        let ip = '';
        if (typeof response.data === 'string') {
            ip = response.data.trim();
        } else if (response.data.ip) {
            ip = response.data.ip;
        } else if (response.data.ip_address) {
            ip = response.data.ip_address;
        }
        // Validate IPv4 format
        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(ip)) {
            return ip;
        }
        return null;
    } catch (e) {
        console.error(`WARNING: Failed to fetch from ${url}: ${e.message}`);
        return null;
    }
}

/**
 * Main DNS leak check logic
 */
async function main() {
    const args = process.argv.slice(2);
    if (args.length < 1) {
        console.error('Usage: node dns-leak-check.js ');
        console.error('Supported providers: ExpressVPN, Norton-VPN');
        process.exit(1);
    }
    const vpnProvider = args[0];
    if (!VPN_DNS_RANGES[vpnProvider]) {
        console.error(`ERROR: Unsupported VPN provider: ${vpnProvider}`);
        process.exit(1);
    }

    console.log(`Checking DNS leaks for ${vpnProvider}...`);
    const ipResults = [];

    for (const endpoint of LEAK_TEST_ENDPOINTS) {
        console.log(`Querying ${endpoint}...`);
        const ip = await fetchClientIp(endpoint);
        if (ip) {
            ipResults.push(ip);
            console.log(`  Client IP: ${ip}`);
        }
        await new Promise(resolve => setTimeout(resolve, 1000)); // rate limit
    }

    // Deduplicate IPs
    const uniqueIps = [...new Set(ipResults)];
    console.log(`\nUnique client IPs found: ${uniqueIps.join(', ')}`);

    // Check if any IP is in VPN DNS range
    let leakDetected = false;
    for (const ip of uniqueIps) {
        const inVpnRange = VPN_DNS_RANGES[vpnProvider].some(cidr => isIpInCidr(ip, cidr));
        if (!inVpnRange) {
            console.error(`LEAK DETECTED: IP ${ip} is not in ${vpnProvider} DNS range`);
            leakDetected = true;
        } else {
            console.log(`OK: IP ${ip} is in ${vpnProvider} DNS range`);
        }
    }

    if (leakDetected) {
        console.error('\nRESULT: DNS LEAK DETECTED. VPN is not routing DNS traffic correctly.');
        process.exit(1);
    } else {
        console.log('\nRESULT: No DNS leaks detected. All traffic routed through VPN DNS.');
        process.exit(0);
    }
}

main().catch(e => {
    console.error(`FATAL ERROR: ${e.message}`);
    process.exit(1);
});

#!/bin/bash
#
# VPN Protocol Stability & Handshake Benchmark
# Tests connection setup time, packet loss, and throughput for IKEv2 (Norton) vs Lightway (ExpressVPN)
# Methodology: Measures time from VPN connect command to first successful ping, runs 100 ping packets, calculates loss.
# Hardware: Lenovo ThinkPad X1 Carbon Gen 11, 16GB RAM, 300Mbps 5G (Verizon)
# OS: Fedora Workstation 40
# OpenVPN: 2.6.9 (for IKEv2 via strongSwan)
# Lightway client: 1.2.3 (ExpressVPN CLI)
#

set -euo pipefail

# Configuration - update these with your VPN credentials and server details
NORTON_SERVER="us-east.norton-vpn.com"
NORTON_USER="your_norton_username"
NORTON_PASS="your_norton_password"
EXPRESS_SERVER="us-east.expressvpn.com"
EXPRESS_USER="your_expressvpn_username"
EXPRESS_PASS="your_expressvpn_password"
PING_COUNT=100
PING_TIMEOUT=2
TEST_URL="https://www.google.com"

# Check for required dependencies
check_dependencies() {
    local deps=("ping" "curl" "time" "strongswan" "expressvpn-cli")
    for dep in "${deps[@]}"; do
        if ! command -v "$dep" &> /dev/null; then
            echo "ERROR: Dependency $dep not found. Install it before running."
            case "$dep" in
                strongswan) echo "Install via: sudo dnf install strongswan" ;;
                expressvpn-cli) echo "Install via: https://github.com/expressvpn/expressvpn-cli" ;;
            esac
            exit 1
        fi
    done
}

# Test IKEv2 (Norton VPN) connection
test_norton_ikev2() {
    echo "=== Testing Norton VPN (IKEv2) ==="
    local start_time=$(date +%s%N)

    # Start IKEv2 connection via strongSwan
    echo "Connecting to Norton VPN (IKEv2)..."
    sudo strongswan up norton-vpn || {
        echo "ERROR: Failed to start Norton VPN connection"
        return 1
    }

    # Wait for connection to establish (check for tun0 interface)
    local max_wait=30
    local elapsed=0
    while ! ip link show tun0 &> /dev/null; do
        sleep 1
        elapsed=$((elapsed + 1))
        if [ $elapsed -ge $max_wait ]; then
            echo "ERROR: Norton VPN connection timed out after ${max_wait}s"
            sudo strongswan down norton-vpn
            return 1
        fi
    done

    local end_time=$(date +%s%N)
    local handshake_ms=$(( (end_time - start_time) / 1000000 ))
    echo "Handshake time: ${handshake_ms} ms"

    # Test ping packet loss
    echo "Running ${PING_COUNT} ping packets to 8.8.8.8..."
    local ping_output=$(ping -c $PING_COUNT -W $PING_TIMEOUT 8.8.8.8)
    local packet_loss=$(echo "$ping_output" | grep -oP '\d+% packet loss' | cut -d% -f1)
    echo "Packet loss: ${packet_loss}%"

    # Test HTTPS connectivity
    echo "Testing HTTPS connectivity to $TEST_URL..."
    if curl -sSf -o /dev/null "$TEST_URL" --max-time 10; then
        echo "HTTPS connectivity: OK"
    else
        echo "HTTPS connectivity: FAILED"
    fi

    # Disconnect
    sudo strongswan down norton-vpn
    echo "Norton VPN disconnected."
    echo ""
}

# Test Lightway (ExpressVPN) connection
test_expressvpn_lightway() {
    echo "=== Testing ExpressVPN (Lightway) ==="
    local start_time=$(date +%s%N)

    # Start ExpressVPN connection
    echo "Connecting to ExpressVPN (Lightway)..."
    expressvpn-cli connect "$EXPRESS_SERVER" --username "$EXPRESS_USER" --password "$EXPRESS_PASS" || {
        echo "ERROR: Failed to start ExpressVPN connection"
        return 1
    }

    # Wait for connection to establish (check for tun0 interface)
    local max_wait=30
    local elapsed=0
    while ! ip link show tun0 &> /dev/null; do
        sleep 1
        elapsed=$((elapsed + 1))
        if [ $elapsed -ge $max_wait ]; then
            echo "ERROR: ExpressVPN connection timed out after ${max_wait}s"
            expressvpn-cli disconnect
            return 1
        fi
    done

    local end_time=$(date +%s%N)
    local handshake_ms=$(( (end_time - start_time) / 1000000 ))
    echo "Handshake time: ${handshake_ms} ms"

    # Test ping packet loss
    echo "Running ${PING_COUNT} ping packets to 8.8.8.8..."
    local ping_output=$(ping -c $PING_COUNT -W $PING_TIMEOUT 8.8.8.8)
    local packet_loss=$(echo "$ping_output" | grep -oP '\d+% packet loss' | cut -d% -f1)
    echo "Packet loss: ${packet_loss}%"

    # Test HTTPS connectivity
    echo "Testing HTTPS connectivity to $TEST_URL..."
    if curl -sSf -o /dev/null "$TEST_URL" --max-time 10; then
        echo "HTTPS connectivity: OK"
    else
        echo "HTTPS connectivity: FAILED"
    fi

    # Disconnect
    expressvpn-cli disconnect
    echo "ExpressVPN disconnected."
    echo ""
}

# Main execution
echo "VPN Protocol Benchmark Script"
echo "============================="
check_dependencies

# Run tests
test_norton_ikev2
test_expressvpn_lightway

echo "Benchmark complete. Compare handshake times and packet loss values above."