I am reading up on IPSec, and was wondering if I could use wireshark to decrypt ESP packets from IPSEC transport mode sessions that are using a preshared key . From reading this thread, I have gathered that even if the preshared key is already known, it still isn't trivial to decrypt ESP packets because of the ISAKMP process. It looks like a core dump of the router is needed to get the Encryption and Authentication Keys needed for wireshark.
Is this my interpretation of this accurate, and could anyone explain how ISAKMP makes so information from the endpoint is needed? I am having trouble finding explanation that doesn't require more background in cryptography than I have (for example, RFC 2408) (But maybe that is because it can't be explained otherwise?).