This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi there,

I am looking to decrypt some IPSec traffic. I have the capture file, the associated .SA file and the encryption key. The problem is that from what I can see every single line of the 33 SAs has to be entered into the ESP preferences in Wireshark - piece by piece. Is there an easier way to get the information from the SA file to the ESP preferences - perhaps via an import or some other means? Having that many SAs means a whole lot of data to manually enter which makes for potential errors.

Any information would be appreciated.

Thanks,

Les

asked 02 Nov '15, 08:47

LesJarvis's gravatar image

LesJarvis
6112
accept rate: 0%


There is no import function, but you can create the file manually. See my answer to a similar question:

https://ask.wireshark.org/questions/22874/tshark-decrypt-esp-packets-with-command-line-arguments

++UPDATE++

After reading my own post again, I realized that the path to the file is not that clear.

It's the in user preferences directory. You'll see the path to that directory in the Help menu.

Help -> About Wireshark -> Folder [Tab] -> Personal Configuration

Take that folder and add the file name esp_sa to it.

On Windows it's usually:

%APPDATA%\Wireshark\esp_sa

unless you are working with profiles in Wireshark, then it's

%APPDATA%\Wireshark\xxxxx\esp_sa

While xxxxx is the name of the profile.

Regards
Kurt

permanent link

answered 02 Nov '15, 08:51

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 02 Nov '15, 09:03

Thanks Kurt - I appreciate the help! I was able to generate a working esp_sa file by exporting the appropriate data from Excel.

Les

(02 Nov '15, 12:20) LesJarvis

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).

(02 Nov '15, 16:04) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×62
×20
×19
×3

question asked: 02 Nov '15, 08:47

question was seen: 2,874 times

last updated: 02 Nov '15, 16:04

p​o​w​e​r​e​d by O​S​Q​A