Re: [c-nsp] OT: Using wireshark to decode IPSec/ESP

2009-08-05 Thread Benny Amorsen
Dale Shaw writes: > It's been years since I was armpit deep in IPSec but I am assuming the > encryption key it wants is NOT the ISAKMP pre-shared key. Nope, it wants the session key used for that particular session. This can be hard to get, depending on which platforms the IPSEC end points are.

[c-nsp] OT: Using wireshark to decode IPSec/ESP

2009-08-05 Thread Dale Shaw
Hi all, Has anyone used wireshark successfully to decode ESP traffic? The only material I can find online is people having the same problem as me, or people using null encryption. I need to peek inside esp-3des/esp-sha-hmac SAs The wireshark wiki entry is: http://wiki.wireshark.org/ESP_Preferenc