SLTechnology News&Howtos › Network Security ›

Use wireshark to view IPSEC encrypted traffic

Shulou Source: shulou.com Published: 2022-06-01 07:25:26 10月03日 Update

The traffic of IPSEC is encrypted, and even if the packet is caught during debugging, the data content cannot be seen.

By importing the key and configuring the encryption algorithm, wireshark can decrypt the message and let you see the encrypted data.

The link to the introduction of ESP decryption on wireshark's official website:

Https://wiki.wireshark.org/ESP_Preferences

Put it into practice:

Materials required for decryption:

1. Encryption and authentication algorithms, such as 3des-md5

2. Keys and authentication passwords in inbound (decryption) and outbound (encryption) directions

The materials are as follows:

3des-md5

61.1.112-> 100.1.30.10

Encrypto: 0x8475D2F8A6AE8820067E1D924AB44CAE7CC67A6426D660AE

Authentication: 0x78789F3D55DBF772AAED1139A935CEAA

100.1.30.10-> 61.1.1.112

Encrypto: 0x084B873718B82E20C0FD7B0ACB7EB3596D2E550BD8897BB5

Authentication: 0xD50BCE659075CB18B725BB6B70CAB2A8

Wireshark goes to Profile under the Preference menu and finds ESP. The configuration is as follows:

(wireshark 1.6.3)

After confirmation, you can see the decrypted content.

There is a packet in the attachment, so let's get started.