[hipl-users] Re: Wireshark plugin?
- From: Samu Varjonen <samu.varjonen@xxxxxxxxxxx>
- To: hipl-users@xxxxxxxxxxxxx
- Date: Wed, 04 Mar 2009 04:19:47 +0200
Robert Moskowitz kirjoitti:
Miika Komu wrote:
Robert Moskowitz wrote:
Hi,
no, you have to use "ip xfrm state" or "setkey -D".
ok. But I see that I need something for Wireshark so it will parse a
HIP packet properly...
Yes, in the folder <hipl>/patches/ethereal you can find a HIP patch for
the version 1.1.2 of wireshark, that you can use. I am making some
updates to the patches and new binary packages of the wireshark tomorrow
(including the revised patches). So, if you can wait a day you can
choose between patcing and pre-compiled versions.
BR,
Samu Varjonen
Varjonen Samu wrote:
There is an ESP dissector in Wireshark without any patches needed,
in Wireshark see edit->preferences->protocols->ESP. There is some
configuration needed and the keys of course. So it seems it is
possible to see the contents of ESP packets after dumping them, if
you know the keys.
Is there a hipconf command to get the keys?
Robert Moskowitz wrote:
I seem to recall a wireshark plugin?
Would it show the contents of the ESP packets?
Or is there a way to run ESP with the NULL cipher to see what is going
across....
--
BR,
Samu
"Programmer is an organism that changes caffeine into code"
Other related posts:
