[Openswan Users] Ipsec: tcpdump vs pmtu 1446 (Tunnel 3des/md5-96).
Vincent Tamet
vincent.tamet at ilimit.net
Wed Mar 30 06:39:28 EDT 2011
Hi,
I post my problem to a cisco forum (https://supportforums.cisco.com/thread/2067814), wzhang answer to me, my last post:
Thanks you very much !
I can't done the last tcpdump because have a frag problem, explained rapidly in the bottom.
I test with a ping -c 1 -s 1418 192.168.2.5
Encapsulating Security Payload (Tunnel Mode)
IP Tunnel header 20
ESP Header
Security Parameters Index [SPI] 4
Sequence Number 4
Payload data (variable)
Initialization Vector [IV] IOS ESP-DES-3DES 8
Data (Variable) 1446
IP Origin header 20
ICMP Header 8
Data 1418
Padding Encrypt IOS ESP-DES-3DES (variable 0->7) 0
ESP Trailer
Pad Length 8 bits 1
Next Header 8 bits 1
ESP Authentication Data (Variable x4?)
Integrity Check Value [ICV] ESP MD5 96 digest 12
Padding Auth 0
-------
1496 < 1500
I use this to compute the pad:
8+(1446)+1+1= 1456
1456/8 = 182.00
1456-(182*8) = 0 so without padding
If we calcul for a ping -c 1 -s 1419 192.168.2.5
Encapsulating Security Payload (Tunnel Mode)
IP Tunnel header 20
ESP Header
Security Parameters Index [SPI] 4
Sequence Number 4
Payload data (variable)
Initialization Vector [IV] IOS ESP-DES-3DES 8
Data (Variable) 1447
IP Origin header 20
ICMP Header 8
Data 1419
Padding Encrypt IOS ESP-DES-3DES (variable 0->7) 7
ESP Trailer
Pad Length 8 bits 1
Next Header 8 bits 1
ESP Authentication Data (Variable x4?)
Integrity Check Value [ICV] ESP MD5 96 digest 12
Padding Auth 0
-------
1504 > 1500
And for the pad:
8+(1447)+1+1= 1457
1457/8 = 182.12
1457-(182*8) = 1 If not =0 we need to calcul the padding
8-1=7
Still have some problem with fragmentation in cisco, so I not be able to confirm this with tcpdump because the cisco start to fragment my paquet before the 1418 limit size of data, and for now not fragment for 1410 bytes of data but yes do frag for 1411 bytes paquet size: https://supportforums.cisco.com/thread/2075689
Don't know why but always had problem with the 8 magic lost bytes in cisco 8xx product !!!
I have a another discution with a opened tiquet to cisco support for an another lost of 8 bytes: https://supportforums.cisco.com/thread/2058182
And this one is a 8 bytes problem too about a frag problem: https://supportforums.cisco.com/thread/2066638
Best regards.
----- Mail original -----
De: "Vincent Tamet" <vincent.tamet at ilimit.net>
À: users at openswan.org
Envoyé: Mardi 8 Février 2011 16:59:40
Objet: [Openswan Users] Ipsec: tcpdump vs pmtu 1446 (Tunnel 3des/md5-96).
Hi,
I sent 10 days ago this mail to the dev without answer for now.
I'm trying to understand why the MTU in my test tunnel is 1446. (I have the same between two ciscos).
I have done tcpdump -E and use RFC to identify each byte in the trace, so can't understand why the pmtu is 4 bytes lower than I expect.
The 3des seems to use an IV size of simple DES, I do a lot of dump to verify the identification of padding (size of the ping), switch to aes to verify the bytes identifications.
Does the tcpdump -E erase the Auth Pad, a another thing, I'm must miss something but what ????
The 2 linux-box are in the same ethernet lan.
Mode Tunnel: 3des/md5-96
My interpretation:
MTU IP SPI SN IV Data Pad PL NH AUTH
1500 -20 -4 -4 -( 8 x ) -0 -1 -1 -12 = 1450
The PMTU from a "ping -M do -s 1472" give me 1446, why !?
Best regards
Vincent Tamet.
OSG[PCQ]
PS: The dump is from a lan to internet configuration, but it's the same results.
-----------------------------------------------------------------------------
* ping 192.168.3.1 -c 1 -s 2
17:25:56.555463 00:06:5b:8a:a4:2b > 00:24:14:d9:f1:90, ethertype IPv4 (0x0800), length 44: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 30)
192.168.2.5 > 192.168.3.1: ICMP echo request, id 46448, seq 1, length 10
0x0000: 4500 001e 0000 4000 4001 b488 c0a8 0205 E..... at .@.......
0x0010: c0a8 0301 0800 428d b570 0001 0001 ......B..p....
-----------------------------------------------------------------------------
16:25:59.221603 08:1f:f3:e7:0e:65 > 00:23:7d:fd:bb:04, ethertype IPv4 (0x0800), length 94: (tos 0x0, ttl 253, id 1992, offset 0, flags [DF], proto ESP (50), length 80) xx.xx.1.136 > 10.0.0.2: ESP(spi=0xdb14b228,seq=0x8), length 60
0x0000: 4500 0050 07c8 4000 fd32 19cc 505e 0188 E..P.. at ..2..P^..
0x0010: 0a00 0002 db14 b228 0000 0008 5957 445a .......(....YWDZ
0x0020: 5dcd 42b4 4500 001e 0000 4000 3f01 b588 ].B.E..... at .?...
0x0030: c0a8 0205 c0a8 0301 0800 428d b570 0001 ..........B..p..
0x0040: 0001 0004 58c2 f376 69fa ede5 2584 f199 ....X..vi...%...
-----------------------------------------------------------------------------
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Micropayments: https://flattr.com/thing/38387/IPsec-for-Linux-made-easy
Building and Integrating Virtual Private Networks with Openswan:
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155
More information about the Users
mailing list