Content-type: text/html Manpage of IPSEC_SPI

IPSEC_SPI

Section: File Formats (5)
Updated: 26 Jun 2000
Index Return to Main Contents
 

NAME

ipsec_spi - list IPSEC Security Associations  

SYNOPSIS

ipsec spi

cat /proc/net/ipsec_spi

 

DESCRIPTION

/proc/net/ipsec_spi is a read-only file that lists the current IPSEC Security Associations. A Security Association (SA) is a transform through which packet contents are to be processed before being forwarded. A transform can be an IP-in-IP encapsulation, an IPSEC Authentication Header (authentication with no encryption), or an IPSEC Encapsulation Security Payload (encryption, possibly including authentication).

When a packet is passed from a higher networking layer through an IPSEC virtual interface, a search in the extended routing table (see ipsec_eroute(5)) yields a IP protocol number , a Security Parameters Index (SPI) and an effective destination address When an IPSEC packet arrives from the network, its ostensible destination, an SPI and an IP protocol specified by its outermost IPSEC header are used. The destination/SPI/protocol combination is used to select a relevant SA. (See ipsec_spigrp(5) for discussion of how multiple transforms are combined.)

An spi , proto and daddr arguments specify an SAID. Proto is an ASCII string, "ah", "esp" or "tun", specifying the IP protocol. Spi is a number, preceded by '0x' indicating hexadecimal, where each hexadecimal digit represents 4 bits, between 0x100 and 0xffffffff; values from 0x0 to 0xff are reserved. Daddr is a dotted-decimal IPv4 destination address.

An SAID combines the three parameters above, such as: "tun0x101@1.2.3.4"

A table entry consists of:

+
SAID
+
<transform name (proto,encalg,authalg)>:
+
direction (dir=)
+
initialisation vector length and value (iv_bits=, iv=) if non-zero
+
out-of-order window size, number of out-of-order errors, sequence number, recently received packet bitmask, maximum difference between sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA is AH or ESP and if individual items are non-zero
+
extra flags (flags=) if any are set
+
authenticator length in bits (abit=) if non-zero
+
authentication key length in bits (key_bits_a=) if non-zero
+
authentication errors (auth_errs=) if non-zero
+
encryption key length in bits (key_bits_e=) if non-zero
+
encryption size errors (encsize_errs=) if non-zero
+
encryption padding error warnings (encpad_errs=) if non-zero
+
source and destination addresses, as dotted-quads, separated by '->', for IPIP SAs only
+
lifetimes legend, c=current, s=soft limit, h=hard limit (life(c,s,h)=)
+
number of connections to which the SA is allocated (alloc=), if any value is non-zero
+
number of bytes processesd by this SA (bytes=), if any value is non-zero
+
time since machine bootup when the SA was added, in seconds (add=)
+
time since machine bootup when the SA was first used, in seconds (used=), if any value is non-zero
+
number of packets processesd by this SA (packets=), if any value is non-zero
+
time since the last packet was processed, in seconds (idle=), if SA has been used.
 

EXAMPLES

tun0x12a@192.168.43.1 IPIP: dir=out
192.168.43.2 -> 192.168.43.1
life(c,s,h)=bytes(643314,0,0)add(850360,0,0)
use(850464,0,0)packets(7031,0,0)
idle=23

is an outbound IPIP (protocol 4) tunnel-mode SA set up between machines 192.168.43.2 and 192.168.43.1 with an SPI of 12a in hexadecimal that has passed 628 kilobytes of traffic in 7031 packets since it was created, 850 kiloseconds after machine startup, first used 104 seconds after that and has been idle for 23 seconds.

esp0x9a35fc02@192.168.43.2 ESP_3DES_HMAC_MD5:
dir=in ooowin=32 seq=7149 bit=0xffffffff
alen=128 aklen=128 eklen=192
life(c,s,h)=bytes(1222304,0,0)add(850360,0,0)
use(850464,0,0)packets(7149,0,0)
idle=23

is an inbound Encapsulating Security Payload (protocol 50) SA on machine 192.168.43.2 with an SPI of 9a35fc02 that uses 3DES as the encryption cipher, HMAC MD5 as the authentication algorithm, an out-of-order window of 32 packets, a present sequence number of 7149, every one of the last 32 sequence numbers was received, the authenticator length and keys is 128 bits, the encryption key is 192 bits (actually 168 for 3DES since 1 of 8 bits is a parity bit), has passed 1.2 Mbytes of data in 7149 packets, was added 850 kiloseconds after machine boot, first used 104 seconds after that and has been idle for 23 seconds.

 

FILES

/proc/net/ipsec_spi, /usr/local/bin/ipsec  

SEE ALSO

ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_eroute(5), ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_spi(8), ipsec_version(5), ipsec_pf_key(5)  

HISTORY

Written for the Linux FreeS/WAN project <http://www.freeswan.org/> by Richard Guy Briggs.  

BUGS

The add and use times are awkward, displayed in seconds since machine start. It would be better to display them in seconds before now for human readability.

 

Index

NAME
SYNOPSIS
DESCRIPTION
EXAMPLES
FILES
SEE ALSO
HISTORY
BUGS
This document was created by man2html, using the manual pages.
Time: 02:46:48 GMT, July 02, 2000