<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Andy,<br>Using tcpdump I can see each packet only once.<br><br>I discovered the following: the plain text appears only if I type on the other side than I capture the traffic (execute tcpdump).<br><br>So, I guess in this case it is still OK (per your statement): "If you capture at some point outside your ipsec servers you'll see only encrypted traffic."<br><br>BTW, if it is FAQ you can create FAQ section on your site <a href="https://github.com/xelerance/Openswan/wiki" target="_blank">https://github.com/xelerance/Openswan/wiki</a><br><br>Thank you for your help,<br> Michael<br><br><br><div>> Date: Thu, 10 Mar 2016 16:46:07 +0000<br>> From: andy@andynet.net<br>> To: michael_furman@hotmail.com<br>> CC: users@lists.openswan.org<br>> Subject: Re: [Openswan Users] What is wrong: I can see clear text traffic from left to right<br>> <br>> You're seeing the ESP traffic after it's been decrypted. It's to do with the way that the packet<br>> capture hooks into the kernel.<br>> When using the netkey ipsec stack tcpdump will capture an incoming ESP packet twice, both<br>> before and after it's decrypted. But outgoing is only seen after encryption.<br>> <br>> If you capture at some point outside your ipsec servers you'll see only encrypted traffic.<br>> <br>> This gets asked often - see https://lists.strongswan.org/pipermail/users/2012-June/003197.html for example.<br>> <br>> <br>> On Thu, Mar 10, 2016 at 11:13:08AM +0200, Michael Furman wrote:<br>> > Dear Openswan people,I need your help. I have started POC to enable Openswan in our product.Unfortunately I can see clear text traffic from left to right so it is kind of he critical problem that will prevent me from using of Openswan in the production. I have configured Openswan on CentOS 6 using the following instructions: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/Host-To-Host_VPN_Using_Openswan.html The final configuration is below: conn my-tunnel ike=3des-md5 esp=3des-md5 left=172.16.0.2 leftnexthop=%defaultroute leftrsasigkey=0...ww== right=172.16.0.1 rightnexthop=%defaultroute rightrsasigkey=0s...rQ== authby=rsasig keyingtries=10 # load and initiate automatically compress=no auto=start I have tested the connection on both sides:tcpdump -n -i eth0 esp or udp port 500 or udp port 4500tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes10:02:00.444491 IP 172.16.0.2 > 172.16.0.1: ESP(spi=0x8204b310,seq=0x26425), length 12410:02:00.445414 IP 172.16.0.1 > 172.16.0.2: ESP(spi=0xa68b20ef,seq=0x34e1d), length 84 tcpdump -n -i eth0 esp or udp port 500 or udp port 4500tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes10:02:33.123685 IP 172.16.0.1 > 172.16.0.2: ESP(spi=0xa68b20ef,seq=0x34e4c), length 15610:02:33.132466 IP 172.16.0.2 > 172.16.0.1: ESP(spi=0x8204b310,seq=0x26444), length 172 I suppose that any communication from left to right and vice versa will be encrypted by Openswan. I have started the chat server on the left: nc -vv -l 172.16.0.2 1234 And then connected on the write: nc 172.16.0.2 1234 Unfortunately, when I capture the traffic using the following command I can see clear text traffic from left to right:tcpdump -vv -n -s0 -w ipsecchat.cap tcp port 1234 Please note that traffic from write to left is encrypted. What is wrong? Please help. <br>> > -- <br>> > This message has been scanned for viruses and<br>> > dangerous content by MailScanner, and is<br>> > believed to be clean.<br>> > <br>> <br>> > _______________________________________________<br>> > Users@lists.openswan.org<br>> > https://lists.openswan.org/mailman/listinfo/users<br>> > Micropayments: https://flattr.com/thing/38387/IPsec-for-Linux-made-easy<br>> > Building and Integrating Virtual Private Networks with Openswan:<br>> > http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155<br>> <br></div> </div></body>
</html>