[strongSwan] SA establishment is trigerred by icmp traffic, when the rule is added for udp

[Martin Willi]

Hi Divya,

> Why is SA getting created by ICMP traffic, when the rule is added only
> for UDP traffic?

While this might be a little unexpected, it really works this way on
most Linux boxes. The reason is that the ping utility binds a UDP socket
to probe for a source address. While no traffic is actually sent, this
is sufficient to trigger an acquire by the kernel.

If you explicitly set a source address with ping, the bind() is not done
and the SA shouldn't trigger.

Regards
Martin