[hipl-users] Re: Wireshark plugin?
- From: Miika Komu <miika.komu@xxxxxxx>
- To: hipl-users@xxxxxxxxxxxxx
- Date: Tue, 03 Mar 2009 14:57:50 +0200
Robert Moskowitz wrote:
Hi,
no, you have to use "ip xfrm state" or "setkey -D".
Varjonen Samu wrote:
There is an ESP dissector in Wireshark without any patches needed, in
Wireshark see edit->preferences->protocols->ESP. There is some
configuration needed and the keys of course. So it seems it is
possible to see the contents of ESP packets after dumping them, if you
know the keys.
Is there a hipconf command to get the keys?
Robert Moskowitz wrote:
I seem to recall a wireshark plugin?
Would it show the contents of the ESP packets?
Or is there a way to run ESP with the NULL cipher to see what is going
across....
Other related posts:
