osogbetun@aparo:~$ sudo tcpdump -i ipsec0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ipsec0, link-type EN10MB (Ethernet), capture size 96 bytes 21:23:41.671466 IP 213-202-139-87.bas502.dsl.esat.net.l2f > aparo.eng.esat.ie.l2f: l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |... 21:23:42.660788 IP 213-202-139-87.bas502.dsl.esat.net.l2f > aparo.eng.esat.ie.l2f: l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |... 21:23:44.660390 IP 213-202-139-87.bas502.dsl.esat.net.l2f > aparo.eng.esat.ie.l2f: l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |... 21:23:48.660525 IP 213-202-139-87.bas502.dsl.esat.net.l2f > aparo.eng.esat.ie.l2f: l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |... 21:23:56.659715 IP 213-202-139-87.bas502.dsl.esat.net.l2f > aparo.eng.esat.ie.l2f: l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |... 21:24:01.758471 IP aparo.eng.esat.ie.4500 > 213-202-139-87.bas502.dsl.esat.net.15359: UDP, length: 1 21:24:06.659363 IP 213-202-139-87.bas502.dsl.esat.net.l2f > aparo.eng.esat.ie.l2f: l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |... 21:24:16.674231 IP aparo.eng.esat.ie.4500 > 213-202-139-87.bas502.dsl.esat.net.15359: UDP, length: 72 21:24:16.740363 IP aparo.eng.esat.ie.4500 > 213-202-139-87.bas502.dsl.esat.net.15359: UDP, length: 88 uname -a command: Linux aparo 2.4.33.3 #1 SMP Sat Nov 4 21:51:41 GMT 2006 i686 GNU/Linux ipsec eroute command after IPSec SA : osogbetun@aparo:~$ sudo ipsec eroute 0 10.10.1.57/32:1701 -> 213.202.139.87/32:1701 => esp0x40317b79@213.202.139.87:17 osogbetun@aparo:~$ netstat -lun Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State udp 0 0 10.10.1.57:4500 0.0.0.0:* udp 0 0 10.10.1.57:1701 0.0.0.0:* udp 0 0 10.10.1.57:500 0.0.0.0:*