1 Content-type: text/html
3 <HTML><HEAD><TITLE>Manpage of IPSEC_SPI
</TITLE>
6 Section: File Formats (
5)
<BR>Updated:
26 Jun
2000<BR><A HREF=
"#index">Index
</A>
7 <A HREF=
"http://localhost/cgi-bin/man/man2html">Return to Main Contents
</A><HR>
12 <A NAME=
"lbAB"> </A>
15 ipsec_spi - list IPSEC Security Associations
16 <A NAME=
"lbAC"> </A>
27 <B>/proc/net/ipsec_spi
</B>
31 <A NAME=
"lbAD"> </A>
34 <I>/proc/net/ipsec_spi
</I>
36 is a read-only file that lists the current IPSEC Security Associations.
37 A Security Association (SA) is a transform through which packet contents
38 are to be processed before being forwarded. A transform can be an
39 IPv4-in-IPv4 or IPv6-in-IPv6 encapsulation, an IPSEC Authentication Header (authentication
40 with no encryption), or an IPSEC Encapsulation Security Payload
41 (encryption, possibly including authentication).
44 When a packet is passed from a higher networking layer through an IPSEC
45 virtual interface, a search in the extended routing table (see
46 <I><A HREF=
"ipsec_eroute.5.html">ipsec_eroute
</A></I>(
5))
51 a Security Parameters Index (SPI)
53 an effective destination address
54 When an IPSEC packet arrives from the network,
55 its ostensible destination, an SPI and an IP protocol
56 specified by its outermost IPSEC header are used.
57 The destination/SPI/protocol combination is used to select a relevant SA.
59 <I><A HREF=
"ipsec_spigrp.5.html">ipsec_spigrp
</A></I>(
5)
61 for discussion of how multiple transforms are combined.)
74 arguments specify an SAID.
77 is an ASCII string,
"ah
",
"esp
",
"comp
" or
"tun
", specifying the IP protocol.
80 is a number, preceded by '.' indicating hexadecimal and IPv4 or by ':' indicating hexadecimal and IPv6,
81 where each hexadecimal digit represents
4 bits,
97 is a dotted-decimal IPv4 destination address or a coloned hex IPv6 destination address.
103 combines the three parameters above, such as:
"<A HREF=
"mailto:tun.101@1.2.3.4">tun
.101@
1.2.3.4</A>" for IPv4 or
"tun:
<A HREF=
"mailto:101@3049">101@
3049</A>:
1::
1" for IPv6
106 A table entry consists of:
112 <transform name (proto,encalg,authalg)
>:
116 source address (src=)
118 source and destination addresses and masks for inner header policy check
119 addresses (policy=), as dotted-quads or coloned hex, separated by '-
>',
120 for IPv4-in-IPv4 or IPv6-in-IPv6 SAs only
122 initialisation vector length and value (iv_bits=, iv=) if non-zero
124 out-of-order window size, number of out-of-order errors, sequence
125 number, recently received packet bitmask, maximum difference between
126 sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA
127 is AH or ESP and if individual items are non-zero
129 extra flags (flags=) if any are set
131 authenticator length in bits (alen=) if non-zero
133 authentication key length in bits (aklen=) if non-zero
135 authentication errors (auth_errs=) if non-zero
137 encryption key length in bits (eklen=) if non-zero
139 encryption size errors (encr_size_errs=) if non-zero
141 encryption padding error warnings (encr_pad_errs=) if non-zero
143 lifetimes legend, c=Current status, s=Soft limit when exceeded will
144 initiate rekeying, h=Hard limit will cause termination of SA (life(c,s,h)=)
146 number of connections to which the SA is allocated (c), that will cause a
147 rekey (s), that will cause an expiry (h) (alloc=), if any value is non-zero
149 number of bytes processesd by this SA (c), that will cause a rekey (s), that
150 will cause an expiry (h) (bytes=), if any value is non-zero
152 time since the SA was added (c), until rekey (s), until expiry (h), in seconds (add=)
154 time since the SA was first used (c), until rekey (s), until expiry (h), in seconds (used=),
155 if any value is non-zero
157 number of packets processesd by this SA (c), that will cause a rekey (s), that
158 will cause an expiry (h) (packets=), if any value is non-zero
160 time since the last packet was processed, in seconds (idle=), if SA has
163 average compression ratio (ratio=)
165 <A NAME=
"lbAE"> </A>
168 <B><A HREF=
"mailto:tun.12a@192.168.43.1">tun
.12a@
192.168.43.1</A> IPIP: dir=out src=
192.168.43.2</B>
172 <B> life(c,s,h)=bytes(
14073,
0,
0)add(
269,
0,
0)
</B>
176 <B> use(
149,
0,
0)packets(
14,
0,
0)
</B>
184 is an outbound IPv4-in-IPv4 (protocol
4) tunnel-mode SA set up between machines
185 192.168.43.2 and
192.168.43.1 with an SPI of
12a in hexadecimal that has
186 passed about
14 kilobytes of traffic in
14 packets since it was created,
187 269 seconds ago, first used
149 seconds ago and has been idle for
23
191 <B>esp:
<A HREF=
"mailto:9a35fc02@3049">9a35fc02@
3049</A>:
1::
1 ESP_3DES_HMAC_MD5:
</B>
195 <B> dir=in src=
<A HREF=
"mailto:9a35fc02@3049">9a35fc02@
3049</A>:
1::
2</B>
199 <B> ooowin=
32 seq=
7149 bit=
0xffffffff</B>
203 <B> alen=
128 aklen=
128 eklen=
192</B>
207 <B> life(c,s,h)=bytes(
1222304,
0,
0)add(
4593,
0,
0)
</B>
211 <B> use(
3858,
0,
0)packets(
7149,
0,
0)
</B>
219 is an inbound Encapsulating Security Payload (protocol
50) SA on machine
220 3049:
1::
1 with an SPI of
9a35fc02 that uses
3DES as the encryption
221 cipher, HMAC MD5 as the authentication algorithm, an out-of-order
222 window of
32 packets, a present sequence number of
7149, every one of
223 the last
32 sequence numbers was received, the authenticator length and
224 keys is
128 bits, the encryption key is
192 bits (actually
168 for
3DES
225 since
1 of
8 bits is a parity bit), has passed
1.2 Mbytes of data in
226 7149 packets, was added
4593 seconds ago, first used
227 3858 seconds ago and has been idle for
23 seconds.
230 <A NAME=
"lbAF"> </A>
233 /proc/net/ipsec_spi, /usr/local/bin/ipsec
234 <A NAME=
"lbAG"> </A>
237 <A HREF=
"ipsec.8.html">ipsec
</A>(
8),
<A HREF=
"ipsec_manual.8.html">ipsec_manual
</A>(
8),
<A HREF=
"ipsec_tncfg.5.html">ipsec_tncfg
</A>(
5),
<A HREF=
"ipsec_eroute.5.html">ipsec_eroute
</A>(
5),
238 <A HREF=
"ipsec_spigrp.5.html">ipsec_spigrp
</A>(
5),
<A HREF=
"ipsec_klipsdebug.5.html">ipsec_klipsdebug
</A>(
5),
<A HREF=
"ipsec_spi.8.html">ipsec_spi
</A>(
8),
<A HREF=
"ipsec_version.5.html">ipsec_version
</A>(
5),
239 <A HREF=
"ipsec_pf_key.5.html">ipsec_pf_key
</A>(
5)
240 <A NAME=
"lbAH"> </A>
243 Written for the Linux FreeS/WAN project
244 <<A HREF=
"http://www.freeswan.org/">http://www.freeswan.org/
</A>>
245 by Richard Guy Briggs.
246 <A NAME=
"lbAI"> </A>
249 The add and use times are awkward, displayed in seconds since machine
250 start. It would be better to display them in seconds before now for
288 <A NAME=
"index"> </A><H2>Index
</H2>
290 <DT><A HREF=
"#lbAB">NAME
</A><DD>
291 <DT><A HREF=
"#lbAC">SYNOPSIS
</A><DD>
292 <DT><A HREF=
"#lbAD">DESCRIPTION
</A><DD>
293 <DT><A HREF=
"#lbAE">EXAMPLES
</A><DD>
294 <DT><A HREF=
"#lbAF">FILES
</A><DD>
295 <DT><A HREF=
"#lbAG">SEE ALSO
</A><DD>
296 <DT><A HREF=
"#lbAH">HISTORY
</A><DD>
297 <DT><A HREF=
"#lbAI">BUGS
</A><DD>
300 This document was created by
301 <A HREF=
"http://localhost/cgi-bin/man/man2html">man2html
</A>,
302 using the manual pages.
<BR>
303 Time:
21:
40:
18 GMT, November
11,
2003