<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
Tobias, <BR>
Thanks for you clarification. <BR>
Yes, I use the Wireshark located at the same machine with StrongSwan.<BR>
I have other question about this. Why it only happens when the ESP protects a Tunnel mode IP traffic. <BR>
I have never seen that plain text under the transport model. And also does that means the<BR>
the Linux Kernal knows the SA Key which established between Strongswan and my implementation, otherwise<BR>
how it could decrypt the ESP packet.<BR>
<BR>
Thanks<BR>
Michalle<BR> <BR>> Date: Mon, 20 Sep 2010 10:33:50 +0200<BR>> From: tobias@strongswan.org<BR>> To: michalle_oy@hotmail.com<BR>> CC: users@lists.strongswan.org<BR>> Subject: Re: [strongSwan] FW: Is that a security Issue?<BR>> <BR>> Hi Michalle,<BR>> <BR>> > there will be a plain text of ICMP echo request (which decrypyt the<BR>> > orignial ESP packet from my implementation) in the network.<BR>> <BR>> You didn't write on which host you captured the packets with Wireshark. If it<BR>> was on the same host on which strongSwan was running then this behavior is<BR>> normal. It is a quirk of the Linux kernel that for incoming traffic both the<BR>> ESP packet and the decrypted payload are captured and that for outgoing traffic<BR>> only encrypted ESP packets are visible.<BR>> <BR>> Regards,<BR>> Tobias<BR>> <BR> </body>
</html>