diff --git a/TunnelKit/Sources/Core/SessionProxy+PushReply.swift b/TunnelKit/Sources/Core/SessionProxy+PushReply.swift
index 90429ae..4ac96ad 100644
--- a/TunnelKit/Sources/Core/SessionProxy+PushReply.swift
+++ b/TunnelKit/Sources/Core/SessionProxy+PushReply.swift
@@ -190,7 +190,7 @@ extension SessionProxy {
 
         private static let peerIdRegexp = try! NSRegularExpression(pattern: "peer-id [0-9]+", options: [])
 
-        private static let cipherRegexp = try! NSRegularExpression(pattern: "cipher [^\\s]+", options: [])
+        private static let cipherRegexp = try! NSRegularExpression(pattern: "cipher [^,\\s]+", options: [])
         
         private let original: String
 
diff --git a/TunnelKitTests/PushTests.swift b/TunnelKitTests/PushTests.swift
index 1b7820e..5fdf864 100644
--- a/TunnelKitTests/PushTests.swift
+++ b/TunnelKitTests/PushTests.swift
@@ -97,6 +97,14 @@ class PushTests: XCTestCase {
         let reply = try! SessionProxy.PushReply(message: msg)!
         reply.debug()
 
-        XCTAssertEqual(reply.cipher, .aes256cbc)
+        XCTAssertEqual(reply.cipher, .aes256gcm)
+    }
+
+    func testNCPTrailing() {
+        let msg = "PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 4.4.4.4,comp-lzo no,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.18 10.8.0.17,peer-id 3,cipher AES-256-GCM,auth-token"
+        let reply = try! SessionProxy.PushReply(message: msg)!
+        reply.debug()
+        
+        XCTAssertEqual(reply.cipher, .aes256gcm)
     }
 }