Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-19 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > "Torsten" == Torsten Krah writes: Torsten> Hi, Torsten> i am forcing some problems with my ipsec tunnel and want to Torsten> encrypt the real esp traffic going over the wire. Torsten> I did succeed only to 50% because a ping l

[tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-19 Thread Torsten Krah
Hi, i am forcing some problems with my ipsec tunnel and want to encrypt the real esp traffic going over the wire. I did succeed only to 50% because a ping looks like this: IP A > B: ESP(spi=0xf33ec601,seq=0x1dd), length 164 IP B > A: ESP(spi=0x089882f5,seq=0x1e3), length 164 Trying to use -E (

Re: [tcpdump-workers] help with packet tracer

2009-02-19 Thread Tyler Littlefield
thanks, that was it, I think. Does this need to be used for the ID and that too? - Original Message - From: "Gisle Vanem" To: Sent: Thursday, February 19, 2009 6:38 AM Subject: Re: [tcpdump-workers] help with packet tracer the size of the Ip works, but when I get the tcp packet, thi

Re: [tcpdump-workers] help with packet tracer

2009-02-19 Thread Gisle Vanem
the size of the Ip works, but when I get the tcp packet, things don't work as planned--it gives invalid ports. I see: tcp = (tcp_hdr *) ((packet + sizeof (ether_hdr)) + ip_size); cout << "Source port: " << tcp->th_sport << "\t\tDestination port: " << tcp->th_dport << "." << endl; You forgot

Re: [tcpdump-workers] help with packet tracer

2009-02-19 Thread Tyler Littlefield
the size of the Ip works, but when I get the tcp packet, things don't work as planned--it gives invalid ports. - Original Message - From: "Gisle Vanem" To: Sent: Thursday, February 19, 2009 1:29 AM Subject: Re: [tcpdump-workers] help with packet tracer "Tyler Littlefield" wrote: I

Re: [tcpdump-workers] help with packet tracer

2009-02-19 Thread Gisle Vanem
"Tyler Littlefield" wrote: I rewrote my callback function to work a bit differently, but it's still giving me weird sizes. What do you mean exactly? in capt_h(): ip_hdr* ip=(ip_hdr*)(packet+sizeof(ether_hdr)); cout << "From: " << inet_ntoa(ip->ip_src) << "\t\t" << "to: " << inet_ntoa(ip->