Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > "Torsten" == Torsten Krah writes: Torsten> Am Freitag, 20. Februar 2009 02:35:04 schrieb Michael Torsten> Richardson: >> First, are you capturing the entire packet? Torsten> Hm what do you mean with "entire" packet? How do i kn

Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Torsten Krah
Am Freitag, 20. Februar 2009 10:38:45 schrieb Arien Vijn: > To capture the whole frame   > you need to run with: -s 0. thx for this hint - that was my mistake *sigh* - should have remembered this ... thx - it works now. Torsten -- Bitte senden Sie mir keine Word- oder PowerPoint-Anhänge. Siehe

Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Arien Vijn
On 20 Feb. 2009, at 10:29 AM, Torsten Krah wrote: Am Freitag, 20. Februar 2009 02:35:04 schrieb Michael Richardson: First, are you capturing the entire packet? Hm what do you mean with "entire" packet? How do i know this? The command i have used i told - have i have to do something more to

Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-20 Thread Torsten Krah
Am Freitag, 20. Februar 2009 02:35:04 schrieb Michael Richardson: > > First, are you capturing the entire packet? Hm what do you mean with "entire" packet? How do i know this? The command i have used i told - have i have to do something more to get the entire dump? > > Torsten> Command use

Re: [tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-19 Thread Michael Richardson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 > "Torsten" == Torsten Krah writes: Torsten> Hi, Torsten> i am forcing some problems with my ipsec tunnel and want to Torsten> encrypt the real esp traffic going over the wire. Torsten> I did succeed only to 50% because a ping l

[tcpdump-workers] question about -E parameter decrypting esp packets

2009-02-19 Thread Torsten Krah
Hi, i am forcing some problems with my ipsec tunnel and want to encrypt the real esp traffic going over the wire. I did succeed only to 50% because a ping looks like this: IP A > B: ESP(spi=0xf33ec601,seq=0x1dd), length 164 IP B > A: ESP(spi=0x089882f5,seq=0x1e3), length 164 Trying to use -E (