Wireshark · Ethereal-dev: [Ethereal-dev] IPSec diagnostics/audit tool

[Dirk Rösler <dirk@xxxxxxxxxxxxxxx>]

Hello there,

does anyone know of or has suggestions for developing an IPSec (ESP only? -
not sure) diagnostics or audit tool?

I was thinking of being able to verify that the traffic you assume is
protected is indeed protected when looked at from the outside. This could be
very valuable for testing and auditing policy.

For example you could statistically analyse payloads (for encrypted packets
those should be flat, whereas non-encrypted packets should be recognisable)
by using a sniffer such as ethereal or snort - and whatever else can be
deduced from looking at the traffic itself.

I'd be happy to hear your suggestions on what else could be looked at.


Regards

Dirk