Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am reading up on IPSec, and was wondering if I could use wireshark to decrypt ESP packets from IPSEC transport mode sessions that are using a preshared key . From reading this thread, I have gathered that even if the preshared key is already known, it still isn't trivial to decrypt ESP packets because of the ISAKMP process. It looks like a core dump of the router is needed to get the Encryption and Authentication Keys needed for wireshark.

Is this my interpretation of this accurate, and could anyone explain how ISAKMP makes so information from the endpoint is needed? I am having trouble finding explanation that doesn't require more background in cryptography than I have (for example, RFC 2408) (But maybe that is because it can't be explained otherwise?).

share|improve this question
    
I’m no IPsec expert, but I think you can use the “ip xfrm state” to get the IPsec keys that ISAKMP has currently negotiated. –  Jeremy Visser Apr 29 '10 at 9:10
add comment

1 Answer

up vote 2 down vote accepted

Sounds like you're understanding it correctly. The reason you need data from one of the endpoints is because ISAKMP is changing keys periodically and Cisco doesn't provide a "nice way" to access that information. The dumps on each side just let you see what the current key is. It wouldn't be necessary if one of the peers had a utility to retrieve the negotiated keys as they changed.

Edit: It should be noted that to do this he is using a virtual router, not a real router for those unfamiliar with GNS3/Dynamips/Dynagen. He's also stated that if you were creating this VPN using certain linux services rather than a cisco router you would just be able to query the current key without issue.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.