Wireshark has the ability to decrypt IKEv2, if you do Preferences, select ISAKMP, it offers an IKEv2 decrypt table which wants the initiator's and responder's SPIs, the encryption and authentication keys (SK_ei, SK_er, SK_ai, SK_ar) and the encryption and authentication algorithms. Using Strongswan's charon debug logging on all these are available.
I have a working IKEv2 SA and can transfer ESP traffic.
Yet, every time I try to decrypt with Wireshark time it produces incoherent decrypted results, like field lengths of 65000 in a packet that has 166 bytes, and reports malformed packets.
I also can't decrypt the ESP packets. Google searches say this is possible just using the info from 'ip xfrm state' but Wireshark either decrypts nothing or again produces invalid results.
Clearly I am missing something, has anybody done this?
I am using Wireshark 1.8.3, StrongSwan 5.0.1 on Ubuntu 12.04.