Re: [tcpdump-workers] Using tcpdump to decrypt IPSec ESP sessions (none and aes-cbc)

2020-08-06 Thread Denis Ovsienko via tcpdump-workers
--- Begin Message --- On Thu, 6 Aug 2020 11:19:21 -0600 Philip Prindeville via tcpdump-workers wrote: > Hi. > > I’m trying to debug a Strongswan config and wanted to verify that my > GRE traffic is being encapsulated properly by IPSec. “Tcpdump” to > the rescue. Well, almost. > > So I was try

[tcpdump-workers] Using tcpdump to decrypt IPSec ESP sessions (none and aes-cbc)

2020-08-06 Thread Philip Prindeville via tcpdump-workers
--- Begin Message --- Hi. I’m trying to debug a Strongswan config and wanted to verify that my GRE traffic is being encapsulated properly by IPSec. “Tcpdump” to the rescue. Well, almost. So I was trying to use “ip xfrm state” to get the SPI and sessions keys, and then run "tcpdump … -E spi@a