cat /proc/net/ipsec_spigrp
An entry in the IPSEC extended routing table can only point (via an SAID) to one SA. If more than one transform must be applied to a given type of packet, this can be accomplished by setting up several SAs with the same destination address but potentially different SPIs and protocols, and grouping them with ipsec_spigrp(8).
The SA groups are listed, one line per connection/group, as a sequence of SAs to be applied (or that should have been applied, in the case of an incoming packet) from inside to outside the packet. An SA is identified by its SAID, which consists of protocol ("ah", "esp" or "tun"), SPI ('0x'-prefixed hexadecimal number) and destination address (IPv4 dotted quad) prefixed by '@', in the format <proto><spi>@<dest>.
is a group of 3 SAs, destined for 192.168.2.110 with an IP-in-IP tunnel SA applied first with an SPI of 3d0 in hexadecimal, followed by an Encapsulating Security Payload header to encrypt the packet with SPI 187a101b in hexadecimal, followed by an Authentication Header to authenticate the packet with SPI 187a101a in hexadecimal, applied from inside to outside the packet. This could be an incoming or outgoing group, depending on the address of the local machine.