<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:8pt"><div><span>Thank you so much Andres for clarification.</span></div><div style="color: rgb(0, 0, 0); font-size: 11px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 11px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Best Regards,</span></div><div style="color: rgb(0, 0, 0); font-size: 11px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Farid</span></div><div class="yahoo_quoted" style="display: block;"> <br> <br> <div
style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 8pt;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> On Friday, October 18, 2013 2:52 PM, Andreas Steffen <andreas.steffen@strongswan.org> wrote:<br> </font> </div> <div class="y_msg_container">Hi Farid,<br clear="none"><br clear="none">no plaintext packets are transmitted! You only see decrypted payloads<br clear="none">on the inbound side because of the peculiar way tcpdump hooks into the<br clear="none">Linux Netfilter stack. Incoming ESP packets are queued twice in the <br clear="none">Netfilter INPUT chain: first in encrypted form and then again as<br clear="none">plaintext packets.<br clear="none"><br clear="none">If you activate tcpdump on a separate host in front of the VPN<br clear="none">client|server then
you will register encrypted ESP packets only.<br clear="none"><br clear="none">Regards<br clear="none"><br clear="none">Andreas<br clear="none"><br clear="none">On 18.10.2013 18:35, Farid Farid wrote:<br clear="none">> Hi Martin,<br clear="none">><br clear="none">> After establishing the successful secure connection between two hosts I<br clear="none">> am using PING to validate the connectivity.<br clear="none">><br clear="none">> I am capturing the data using TCPDUMP. It is interesting that I can<br clear="none">> still see the ech-request in plain text<br clear="none">> I pinged from both sides but no matter what I can see echo-request<br clear="none">> in plain text.<br clear="none">> Below you can see output of TCPDUMP:<br clear="none">><br clear="none">> 16:29:40.455844 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x26), length 132<br
clear="none">> 16:29:40.456164 IP 192.168.1.209 > 192.168.1.55: ICMP echo request, id<br clear="none">> 19103, seq 1, length 64<br clear="none">> 16:29:40.456654 IP 192.168.1.55 > 192.168.1.209:<br clear="none">> ESP(spi=0xc51dee21,seq=0x26), length 132<br clear="none">> 16:29:41.457091 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x27), length 132<br clear="none">> 16:29:41.457406 IP 192.168.1.209 > 192.168.1.55: ICMP echo request, id<br clear="none">> 19103, seq 2, length 64<br clear="none">> 16:29:41.457844 IP 192.168.1.55 > 192.168.1.209:<br clear="none">> ESP(spi=0xc51dee21,seq=0x27), length 132<br clear="none">> 16:29:42.458345 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x28), length 132<br clear="none">> 16:29:42.458658 IP 192.168.1.209 > 192.168.1.55: ICMP echo request, id<br clear="none">> 19103, seq 3, length 64<br
clear="none">> 16:29:42.459092 IP 192.168.1.55 > 192.168.1.209:<br clear="none">> ESP(spi=0xc51dee21,seq=0x28), length 132<br clear="none">> 16:29:43.459526 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x29), length 132<br clear="none">> 16:29:43.459844 IP 192.168.1.209 > 192.168.1.55: ICMP echo request, id<br clear="none">> 19103, seq 4, length 64<br clear="none">> 16:29:43.460283 IP 192.168.1.55 > 192.168.1.209:<br clear="none">> ESP(spi=0xc51dee21,seq=0x29), length 132<br clear="none">> 16:29:44.460732 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x2a), length 132<br clear="none">> 16:29:44.461050 IP 192.168.1.209 > 192.168.1.55: ICMP echo request, id<br clear="none">> 19103, seq 5, length 64<br clear="none">> 16:29:44.461552 IP 192.168.1.55 > 192.168.1.209:<br clear="none">> ESP(spi=0xc51dee21,seq=0x2a), length 132<br
clear="none">> 16:29:45.462021 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x2b), length 132<br clear="none">> 16:29:45.462338 IP 192.168.1.209 > 192.168.1.55: ICMP echo request, id<br clear="none">> 19103, seq 6, length 64<br clear="none">> 16:29:45.462773 IP 192.168.1.55 > 192.168.1.209:<br clear="none">> ESP(spi=0xc51dee21,seq=0x2b), length 132<br clear="none">> 16:29:46.463225 IP 192.168.1.209 > 192.168.1.55:<br clear="none">> ESP(spi=0xcaec41a1,seq=0x2c), length 132<br clear="none">><br clear="none">><br clear="none">><br clear="none">> Am I supposed to see one packet in plain text? would it be any reason<br clear="none">> for it?<br clear="none">><br clear="none">> Thanks a lot for your help.<br clear="none">><br clear="none">> Farid<br clear="none">><br clear="none">><br clear="none">> On Friday, October 18, 2013 9:08 AM, Farid Farid <<a
shape="rect" ymailto="mailto:farid21657@yahoo.com" href="mailto:farid21657@yahoo.com">farid21657@yahoo.com</a>><br clear="none">> wrote:<br clear="none">> Thanks Martin for the good detail. Yes that was the problem. It works<br clear="none">> with IKvE2.<br clear="none">><br clear="none">> Best Regards,<br clear="none">> Farid<br clear="none">><br clear="none">><br clear="none">> On Thursday, October 17, 2013 11:49 PM, Martin Willi<br clear="none">> <<a shape="rect" ymailto="mailto:martin@strongswan.org" href="mailto:martin@strongswan.org">martin@strongswan.org</a>> wrote:<br clear="none">> Hi Farid,<br clear="none">><br clear="none">> > I have observed if I select charonstat=yes and plutostart=no ipsec<br clear="none">> > is not listening in all interfaces<br clear="none">><br clear="none">> With strongSwan 4.x, two IKE daemons have been in use. Pluto
handled<br clear="none">> IKEv1 connections, while charon was responsible to handle IKEv2<br clear="none">> connections.<br clear="none">><br clear="none">> Both protocols receive messages on port 500/4500, but only one process<br clear="none">> can bind to it. As a work-around, charon used a RAW socket to receive<br clear="none">> packets, but did not bind to the UDP port. This allowed both daemons to<br clear="none">> receive packets for their protocol.<br clear="none">><br clear="none">><br clear="none">> > and it never receives any connection from outside.<br clear="none">><br clear="none">><br clear="none">> charon ignores IKEv1 packets, but it should receive packets for IKEv2.<br clear="none">> If you have IKEv1 connections, you'll need to start pluto.<br clear="none">><br clear="none">><br clear="none">> With 5.x releases, things have changed; charon now handles both IKEv1<br
clear="none">> and IKEv2 over a standard UDP socket, pluto is not required anymore.<br clear="none">><br clear="none">> Regards<br clear="none">> Martin<br clear="none">><br clear="none">><br clear="none">><br clear="none">><br clear="none">><br clear="none">> _______________________________________________<br clear="none">> Users mailing list<br clear="none">> <a shape="rect" ymailto="mailto:Users@lists.strongswan.org" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a shape="rect" ymailto="mailto:Users@lists.strongswan.org" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>><br clear="none">> <a shape="rect" href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><div class="yqt3829753386" id="yqtfd69083"><br clear="none">><br clear="none">><br clear="none">><br
clear="none">><br clear="none">> _______________________________________________<br clear="none">> Users mailing list<br clear="none">> <a shape="rect" ymailto="mailto:Users@lists.strongswan.org" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br clear="none">> <a shape="rect" href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a></div><br clear="none">><br clear="none"><br clear="none">-- <br clear="none">======================================================================<br clear="none">Andreas Steffen <a shape="rect" ymailto="mailto:andreas.steffen@strongswan.org" href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br clear="none">strongSwan - the Open Source VPN Solution!
www.strongswan.org<br clear="none">Institute for Internet Technologies and Applications<br clear="none">University of Applied Sciences Rapperswil<br clear="none">CH-8640 Rapperswil (Switzerland)<br clear="none">===========================================================[ITA-HSR]==<div class="yqt3829753386" id="yqtfd30923"><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>