ipsec tunnel and encrypted payload

[sarahr202]

Hi everybody

R1===ipsec tunnel=====R3

when i issue the ping at R1,  and use wireshark to see how the encrypted ping might look like, I was not able to see any encrypted ping packet, all i see ESP .  Is it because wireshark not able to show it?  Please check the attached wireshark file ,towards the end, you will find  ESP packets.

Thanks and happy holidays

[cflory · Accepted solution]

You could either set your capture on the non-encrypted interfaces of your R1 or R3 routers, or set up Wireshark to decode on the encrypted side:

http://wiki.wireshark.org/ESP_Preferences

It would probably be easier to just sniff on the non-encrypted interface, but that depends on entirely what you need to see as it leaves the encrypted interface of the router.

HTH!