Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Torsten Krah
Am Freitag, 20. Februar 2009 10:38:45 schrieb Arien Vijn: > To capture the whole frame   > you need to run with: -s 0. thx for this hint - that was my mistake *sigh* - should have remembered this ... thx - it works now. Torsten -- Bitte senden Sie mir keine Word- oder PowerPoint-Anhänge. Siehe

Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Torsten Krah
Am Freitag, 20. Februar 2009 02:35:04 schrieb Michael Richardson: > > First, are you capturing the entire packet? Hm what do you mean with "entire" packet? How do i know this? The command i have used i told - have i have to do something more to get the entire dump? > > Torsten> Command use

[tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-19 Thread Torsten Krah
Hi, i am forcing some problems with my ipsec tunnel and want to encrypt the real esp traffic going over the wire. I did succeed only to 50% because a ping looks like this: IP A > B: ESP(spi=0xf33ec601,seq=0x1dd), length 164 IP B > A: ESP(spi=0x089882f5,seq=0x1e3), length 164 Trying to use -E (

[tcpdump-workers] tcpdump -E decryption question

2008-07-01 Thread Torsten Krah
Hi, theres no "user" list but i hope i can post here too. Searching the archives i found this: http://www.tcpdump.org/lists/workers/2003/09/msg00011.html 192.1.2.23 > 192.1.2.45: ESP(spi=0x12345678,seq=0x1): 192.0.2.1 > 192.0.1.1: icmp: echo request (DF) (ipip-proto-4) This should be the output