Wireshark · Wireshark-users: Re: [Wireshark-users] how can I see ESP packets

[Sake Blok <sake@xxxxxxxxxx>]

On Tue, Oct 27, 2009 at 02:16:16PM -0700, Dave Braucht wrote:
>    I am troubleshooting an IPSec VPN pass-through issue on a firewall. I am
>    using wireshark 1.2.1.
>     
>    I want to be able to see the ESP packets. I don't care to decrypt them. I
>    just want to see them in the capture. I see ISAKMP, but not my ESP.
>     
>    Is there a setting that I need to enable to allow me to see the ESP packet
>    (protocol 50)?

Wireshark should show packets with IP protocol 50 as ESP. What I think
might be the issue is that nat-traversal might be used between the vpn
endpoints. This means the ESP traffic is encapsulated either in TCP or
UDP. Do you see other traffic between the endpoints that exchange the
ISAKMP traffic? If so, use "decode as" to dissect the traffic as ESP.
You can do this by decoding the TCP or UDP port to TCPENCAP or UDPENCAP.

For example, I recently decoded UDP port 49000 as UDPENCAP to make the
ESP traffic of a remote access VPN connection visible.

Hope this helps,
Cheers,
     Sake