tcpdump and ipsec

[VANHULLEBUS Yvan]

On Fri, Mar 31, 2006 at 03:18:32PM -0500, Eric W. Bates wrote:
> This seems like a dumb question; but I wonder if one can use tcpdump to
> view the decrypted out flow from and esp tunnel?
> 
> I have an established tunnel on machine 'firewall'.
> 
> The tunnel is a route between net 10.128.10.0/24 and 192.168.10.0/24.
> 
> 'firewall' has 192.168.10.1 as the ip on its internal interface.
> 
> When I ping 10.128.10.1 using 192.168.10.1 as the source address, I can
> use tcpdump to view the esp packets via the external interface.
> 
> Is there a way to use tcpdump to view the packets as they traverse from
> the tunnel to 192.168.10.1?  I had no luck attaching tcpdump to the
> internal interface.
> 
> By the same token, can I hook any of the traffic with ipfw?
> 
> I suspect that if any of this traffic were leaving the machine, I would
> see it; but maybe not if 'firewall' itself is the destination?

You can do that by various ways:

1) Use the ESP decryption option of tcpdump. Of course, you'll have to
   provide the encryption key to tcpdump.

2) use enc0 support, which is actually pr kern/94829, and which should
   be included soon in kernel.


Yvan.

-- 
NETASQ - Secure Internet Connectivity
http://www.netasq.com