Lina, I did not follow the thread, but you might save time by using tcpdump instead of patching and compiling ethereal. Its output looks, for example, like this: # /usr/sbin/tcpdump -n -i eth0 esp or proto 139 or proto 253 or port 50500 listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 17:44:19.334351 IP6 2001:708:140:220::f > 2001:708:140:220::2: ip-proto-139 208 17:44:19.336894 IP6 2001:708:140:220::2 > 2001:708:140:220::f: ip-proto-139 120 17:44:44.087729 IP6 2001:708:140:220::f > 2001:708:140:220::2: ip-proto-139 40 17:44:44.088469 IP6 2001:708:140:220::2 > 2001:708:140:220::f: ip-proto-139 832 17:44:44.119395 IP6 2001:708:140:220::f > 2001:708:140:220::2: ip-proto-139 656 17:44:44.143820 IP6 2001:708:140:220::2 > 2001:708:140:220::f: ip-proto-139 128 17:44:44.146324 IP6 2001:708:140:220::f > 2001:708:140:220::2: ESP(spi=0xf97943a5,seq=0x1), length 116 17:44:44.146560 IP6 2001:708:140:220::2 > 2001:708:140:220::f: ESP(spi=0x482279a0,seq=0x1), length 116 -- Regards, Oleg.