A table entry consists of:
Addresses are written as IPv4 dotted quads or IPv6 coloned hex, protocol is one of "ah", "esp", "comp" or "tun" and SPIs are prefixed hexadecimal numbers where the prefix '.' is for IPv4 and the prefix ':' is for IPv6
SAIDs are written as "protoafSPI@edst". There are also 5 "magic" SAIDs which have special meaning:
1867 172.31.252.0/24 -> 0.0.0.0/0 => tun.130@192.168.43.1
() ()
means that 1,867 packets have been sent to an
eroute
that has been set up to protect traffic between the subnet
172.31.252.0
with a subnet mask of
24
bits and the default address/mask represented by an address of
0.0.0.0
with a subnet mask of
0
bits using the local machine as a security gateway on this end of the
tunnel and the machine
192.168.43.1
on the other end of the tunnel with a Security Association IDentifier of
tun0x130@192.168.43.1
which means that it is a tunnel mode connection (4, IPPROTO_IPIP) with a
Security Parameters Index of
130
in hexadecimal with no identies defined for either end.
125 3049:1::/64 -> 0:0/0 => tun:130@3058:4::5 () ()
means that 125 packets have been sent to an
eroute
that has been set up to protect traffic between the subnet
3049:1::
with a subnet mask of
64
bits and the default address/mask represented by an address of
0:0
with a subnet mask of
0
bits using the local machine as a security gateway on this end of the
tunnel and the machine
3058:4::5
on the other end of the tunnel with a Security Association IDentifier of
tun:130@3058:4::5
which means that it is a tunnel mode connection with a
Security Parameters Index of
130
in hexadecimal with no identies defined for either end.
42 192.168.6.0/24 -> 192.168.7.0/24 => %passthrough
means that 42 packets have been sent to an eroute that has been set up to pass the traffic from the subnet 192.168.6.0 with a subnet mask of 24 bits and to subnet 192.168.7.0 with a subnet mask of 24 bits without any IPSEC processing with no identies defined for either end.
2112 192.168.8.55/32 -> 192.168.9.47/24 => %hold (east) ()
means that 2112 packets have been sent to an
eroute
that has been set up to hold the traffic from the host
192.168.8.55
and to host
192.168.9.47
until a key exchange from a Key Management daemon
succeeds and puts in an SA or fails and puts in a pass
or drop eroute depending on the default configuration with the local client
defined as "east" and no identy defined for the remote end.
2001 192.168.2.110/32 -> 192.168.2.120/32 =>
esp.e6de@192.168.2.120 () ()
means that 2001 packets have been sent to an
eroute
that has been set up to protect traffic between the host
192.168.2.110
and the host
192.168.2.120
using
192.168.2.110
as a security gateway on this end of the
connection and the machine
192.168.2.120
on the other end of the connection with a Security Association IDentifier of
esp.e6de@192.168.2.120
which means that it is a transport mode connection with a Security
Parameters Index of
e6de
in hexadecimal using Encapsuation Security Payload protocol (50,
IPPROTO_ESP) with no identies defined for either end.
1984 3049:1::110/128 -> 3049:1::120/128 =>
ah:f5ed@3049:1::120 () ()
means that 1984 packets have been sent to an
eroute
that has been set up to authenticate traffic between the host
3049:1::110
and the host
3049:1::120
using
3049:1::110
as a security gateway on this end of the
connection and the machine
3049:1::120
on the other end of the connection with a Security Association IDentifier of
ah:f5ed@3049:1::120
which means that it is a transport mode connection with a Security
Parameters Index of
f5ed
in hexadecimal using Authentication Header protocol (51,
IPPROTO_AH) with no identies defined for either end.