Skip to content

Instantly share code, notes, and snippets.

@brb

brb/tshark-esp.sh

Created February 10, 2017 16:29
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save brb/3e634b268193ada4fe20d9743de6b96e to your computer and use it in GitHub Desktop.
Save brb/3e634b268193ada4fe20d9743de6b96e to your computer and use it in GitHub Desktop.
Download ZIP
Decrypt AES-GCM ESP (VXLAN) packets
Raw
tshark-esp.sh
#!/bin/sh
set -eu
HOST=$1
PCAP=$2
AWK_CMD='{print "\"IPv4\",\"" $2 "\",\"" substr($4, 1, length($4)-1) "\",\"" $8 "\",\"AES-GCM [RFC4106]\",\"" $19 "\",\"ANY 128 bit authentication [no checking]\",\"\""}'
ssh $HOST "sudo ip -o xfrm state" | awk "$AWK_CMD" >> $HOME/.config/wireshark/esp_sa
tshark -o esp.enable_encryption_decode:TRUE -d udp.port==6784,vxlan -nr $PCAP esp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment