This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a virtual network setup of 2 ubuntu and 2 IPFire with a fifth virtual machine on which I installed Wireshark, I named that VM "Sniffer". Each ubuntu is connected to an IPFire which acts as a gateway connected to another network which is exactly the same. I have been able to monitor the packets flowing from network 1 to network 2, including IPsec ESP packets, put I have no idea on how can I decrypt this packets through Wireshark. What do I need to do or have to decrypt IPsec packets using Wireshark?

I am using IKEv2 ESP Encryption.

I just need to be put on the road :)

asked 26 Oct '14, 05:52

Mohamed%20Ahmed's gravatar image

Mohamed Ahmed
16115
accept rate: 0%

edited 26 Oct '14, 06:15


Have you looked at the wiki page for esp?

permanent link

answered 26 Oct '14, 06:54

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 26 Oct '14, 06:56

To be honest, I have seen it but not read it. But it seems that the only way I can decrypt ESP packets using Wireshark is by providing it with the security parameters of the tunnel, so it doesn't allow me to crack IPsec without an insider knowledge of the security tunnel being inspected. Is that the correct understanding of the situation?

(26 Oct '14, 08:11) Mohamed Ahmed
2

Yes this is correct.

(26 Oct '14, 08:34) Pascal Quantin
3

If you could simply decrypt the packets off the wire, with no information other than the packets themselves, that would kind of defeat the purpose of ESP and encryption altogether. :)

(26 Oct '14, 09:29) Quadratic

Yes, I thought so. But I guess everything is cracked by the NSA, but we don't have their tools :)

(26 Oct '14, 10:30) Mohamed Ahmed

Additionally to the wiki, you could check/read my answer to a similar question.

https://ask.wireshark.org/questions/12019/how-can-i-decrypt-ikev1-andor-esp-packets

Regards
Kurt

permanent link

answered 26 Oct '14, 15:21

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×165
×19

question asked: 26 Oct '14, 05:52

question was seen: 16,808 times

last updated: 26 Oct '14, 15:21

p​o​w​e​r​e​d by O​S​Q​A