[Openswan Users] Decrypt ESP packets with wireshark for tunnel mode (Openswan)

[Kevin Wilson]

Hello,
I want to be able to decrypt ESP packets which are sent with openswan IPsec
client in tunnel mode with wireshark.
In wireshark, we have under Edit->Preferences->Protocols
the following fields:
	
 Attempt to detect/decode encrypted ESP payloads
Encryption Algorithm #1

where you can choose from the following list:
	"NULL",
	"TripleDES-CBC [RFC2451]",
	"AES-CBC [RFC3602]",
	"AES-CTR [RFC3686]",
	"DES-CBC [RFC2405]",
	"CAST5-CBC [RFC2144]",
	"BLOWFISH-CBC [RFC2451]",
	"TWOFISH-CBC",

Encryption Algorithm #2. (with same options)

SA#1
SA#2
Encryption key #1
Encryption key #2
	  (and some more fields)
	
What should I add in /etc/ipsec.conf so that I can use wireshark to sniff
traffic ? I tried some entries  (like ike=null, phase2alg=null), but the
ESP packet is still showed as decrypted in the sniffer. I do know of course
the keys on both sides (these are preshared keys).
It would be helpful if anybody which tried sniffing and decrypting ESP packets
could comment or give some info about it.
	
	
Rgs,
Kevin