I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point that the communication is failing, but other than a few ARPs and DNS packets, everything else that is captured is an ESP (Encapsultating Security Payload) encrypted packet.
I would understand this if I were doing a man-in-the-middle capture, but I am on the source machine. Is there a way to specify that Wireshark capture farther up the stack (after the decryption is complete)? Source machine is W2K8R2 running as a Hyper-V VM if it matters.