How to read a WebRTC test: public, local and mDNS candidates
A WebRTC test shows connection candidates gathered by this browser. Its findings describe one browser networking mechanism, rather than a complete verdict on your VPN or privacy.
What the test does
After you choose Run test, 2FAOrbit creates a temporary data-channel connection and asks the browser to gather candidates using Cloudflare’s public STUN service. It does not request a camera or microphone stream. The connection closes when gathering ends, you cancel, or you leave the page.
Public addresses
A STUN candidate can contain a public address visible along that network path. Compare every public address in the result with the VPN exit or other connection you expect. If IPv4 and IPv6 both appear, compare each family with the corresponding expected address.
Local addresses and mDNS
A host candidate can describe a local interface. Browsers may substitute a name ending in .local instead of exposing a numeric local IP. The result labels that as an mDNS name. “Not observed” means no such candidate was collected; it should not be read as a promise that all local information is hidden.
What an inconclusive result means
A browser policy, unavailable WebRTC API, blocked STUN connection or collection timeout can prevent a public candidate from appearing. An empty result does not establish that every network path is protected. Review the browser’s configuration, check the connection and try again if that is the question you are investigating.
A useful comparison
- Note the expected public IPv4 and IPv6 addresses from your VPN or network settings.
- Run the WebRTC test in the browser you actually use.
- Compare the listed public candidates, then inspect any unexpected address.
- Use DNS testing separately to investigate resolver behavior.
The copy action includes the displayed findings and timestamp. Review that report before sharing it, because network addresses can be included.
References: WebRTC candidate gathering and Cloudflare STUN service.