hey guys... trying to get a host-to-host vpn up between two servers... it *appears* to be working however i'm trying to do some testing with tcpdump to make sure it's actually encrypting the data...
from server b running `ping -p feedfacedeadbeef server-a`
i see on server a `tcpdump -i eth0 host server-b -x`
Code:
21:03:31.582575 IP server-a > server-b: ESP(spi=0x651bd3dd,seq=0x24)
0x0000: 4500 0098 7805 0000 4032 35da 4655 1fc2 E...x...@25.FU..
0x0010: 4655 1fe9 651b d3dd 0000 0024 c029 364e FU..e......$.)6N
0x0020: cbaa 4234 8db2 0577 10a9 bb8b 905d 2de9 ..B4...w.....]-.
0x0030: 57b4 242a 43af 1526 cab9 4e1b 8c2c e71b W.$*C..&..N..,..
0x0040: a2a2 aa06 fcbc 23b6 0cf0 8667 6d52 a3f6 ......#....gmR..
0x0050: 5247 RG
21:03:32.601102 IP server-b > server-a: ESP(spi=0x4172ce43,seq=0x25)
0x0000: 4500 0098 706c 4000 3f32 fe72 4655 1fe9 E...pl@.?2.rFU..
0x0010: 4655 1fc2 4172 ce43 0000 0025 7a98 2d71 FU..Ar.C...%z.-q
0x0020: d333 006c 3203 a471 043a 9320 4e63 0b2b .3.l2..q.:..Nc.+
0x0030: 578f b2f4 4c73 cdae 0a31 84ec 7c40 f300 W...Ls...1..|@..
0x0040: 1a7d 037b 6880 00a0 21ed 7b3d 6a0a 6d73 .}.{h...!.{=j.ms
0x0050: e4ce ..
21:03:32.601102 IP server-b > server-a: icmp 64: echo request seq 56
0x0000: 4500 0054 0038 4000 4001 6e1c 4655 1fe9 E..T.8@.@.n.FU..
0x0010: 4655 1fc2 0800 8120 5006 0038 e414 9942 FU......P..8...B
0x0020: 142a 0900 feed face dead beef feed face .*..............
0x0030: dead beef feed face dead beef feed face ................
0x0040: dead beef feed face dead beef feed face ................
0x0050: dead ..
Now I've read that if you see the ESP packets... your set... however I'm also seeing the clear text packets...
Just want to make sure... is this only because this is a host-to-host tunnel and it's decrypting the packets... ?
Or could it be circumventing the tunnel - ?
FAQ
Search
Members
Register
Login [ Anonymous ]
