1IPSEC_SPI(5)                    [FIXME: manual]                   IPSEC_SPI(5)
2
3
4

NAME

6       ipsec_spi - list IPSEC Security Associations
7

SYNOPSIS

9       ipsec spi
10             cat/proc/net/ipsec_spi
11
12

OBSOLETE

14       Note that eroute is only supported on the classic KLIPS stack. It is
15       not supported on any other stack and will be completely removed in
16       future versions. A replacement command still needs to be designed
17

DESCRIPTION

19       /proc/net/ipsec_spi is a read-only file that lists the current IPSEC
20       Security Associations. A Security Association (SA) is a transform
21       through which packet contents are to be processed before being
22       forwarded. A transform can be an IPv4-in-IPv4 or IPv6-in-IPv6
23       encapsulation, an IPSEC Authentication Header (authentication with no
24       encryption), or an IPSEC Encapsulation Security Payload (encryption,
25       possibly including authentication).
26
27       When a packet is passed from a higher networking layer through an IPSEC
28       virtual interface, a search in the extended routing table (see
29       ipsec_eroute(5)) yields a IP protocol number , a Security Parameters
30       Index (SPI) and an effective destination address When an IPSEC packet
31       arrives from the network, its ostensible destination, an SPI and an IP
32       protocol specified by its outermost IPSEC header are used. The
33       destination/SPI/protocol combination is used to select a relevant SA.
34       (See ipsec_spigrp(5) for discussion of how multiple transforms are
35       combined.)
36
37       An spi , proto, daddr and address_family arguments specify an SAID.
38       Proto is an ASCII string, "ah", "esp", "comp" or "tun", specifying the
39       IP protocol.  Spi is a number, preceded by ´.´ indicating hexadecimal
40       and IPv4 or by ´:´ indicating hexadecimal and IPv6, where each
41       hexadecimal digit represents 4 bits, between 0x100 and 0xffffffff;
42       values from 0x0 to 0xff are reserved.  Daddr is a dotted-decimal IPv4
43       destination address or a coloned hex IPv6 destination address.
44
45       An SAID combines the three parameters above, such as: "tun.101@1.2.3.4"
46       for IPv4 or "tun:101@3049:1::1" for IPv6
47
48       A table entry consists of:
49
50       +
51           SAID
52
53       +
54           <transform name (proto,encalg,authalg)>:
55
56       +
57           direction (dir=)
58
59       +
60           source address (src=)
61
62       +
63           source and destination addresses and masks for inner header policy
64           check addresses (policy=), as dotted-quads or coloned hex,
65           separated by ´->´, for IPv4-in-IPv4 or IPv6-in-IPv6 SAs only
66
67       +
68           initialisation vector length and value (iv_bits=, iv=) if non-zero
69
70       +
71           out-of-order window size, number of out-of-order errors, sequence
72           number, recently received packet bitmask, maximum difference
73           between sequence numbers (ooowin=, ooo_errs=, seq=, bit=,
74           max_seq_diff=) if SA is AH or ESP and if individual items are
75           non-zero
76
77       +
78           extra flags (flags=) if any are set
79
80       +
81           authenticator length in bits (alen=) if non-zero
82
83       +
84           authentication key length in bits (aklen=) if non-zero
85
86       +
87           authentication errors (auth_errs=) if non-zero
88
89       +
90           encryption key length in bits (eklen=) if non-zero
91
92       +
93           encryption size errors (encr_size_errs=) if non-zero
94
95       +
96           encryption padding error warnings (encr_pad_errs=) if non-zero
97
98       +
99           lifetimes legend, c=Current status, s=Soft limit when exceeded will
100           initiate rekeying, h=Hard limit will cause termination of SA
101           (life(c,s,h)=)
102
103       +
104           number of connections to which the SA is allocated (c), that will
105           cause a rekey (s), that will cause an expiry (h) (alloc=), if any
106           value is non-zero
107
108       +
109           number of bytes processesd by this SA (c), that will cause a rekey
110           (s), that will cause an expiry (h) (bytes=), if any value is
111           non-zero
112
113       +
114           time since the SA was added (c), until rekey (s), until expiry (h),
115           in seconds (add=)
116
117       +
118           time since the SA was first used (c), until rekey (s), until expiry
119           (h), in seconds (used=), if any value is non-zero
120
121       +
122           number of packets processesd by this SA (c), that will cause a
123           rekey (s), that will cause an expiry (h) (packets=), if any value
124           is non-zero
125
126       +
127           time since the last packet was processed, in seconds (idle=), if SA
128           has been used
129
130           average compression ratio (ratio=)
131

EXAMPLES

133       tun.12a@192.168.43.1 IPIP: dir=out src=192.168.43.2
134
135        life(c,s,h)=bytes(14073,0,0)add(269,0,0)
136
137        use(149,0,0)packets(14,0,0)
138
139        idle=23
140
141       is an outbound IPv4-in-IPv4 (protocol 4) tunnel-mode SA set up between
142       machines 192.168.43.2 and 192.168.43.1 with an SPI of 12a in
143       hexadecimal that has passed about 14 kilobytes of traffic in 14 packets
144       since it was created, 269 seconds ago, first used 149 seconds ago and
145       has been idle for 23 seconds.
146
147       esp:9a35fc02@3049:1::1 ESP_3DES_HMAC_MD5:
148
149        dir=in src=9a35fc02@3049:1::2
150
151        ooowin=32 seq=7149 bit=0xffffffff
152
153        alen=128 aklen=128 eklen=192
154
155        life(c,s,h)=bytes(1222304,0,0)add(4593,0,0)
156
157        use(3858,0,0)packets(7149,0,0)
158
159        idle=23
160
161       is an inbound Encapsulating Security Payload (protocol 50) SA on
162       machine 3049:1::1 with an SPI of 9a35fc02 that uses 3DES as the
163       encryption cipher, HMAC MD5 as the authentication algorithm, an
164       out-of-order window of 32 packets, a present sequence number of 7149,
165       every one of the last 32 sequence numbers was received, the
166       authenticator length and keys is 128 bits, the encryption key is 192
167       bits (actually 168 for 3DES since 1 of 8 bits is a parity bit), has
168       passed 1.2 Mbytes of data in 7149 packets, was added 4593 seconds ago,
169       first used 3858 seconds ago and has been idle for 23 seconds.
170

FILES

172       /proc/net/ipsec_spi, /usr/local/bin/ipsec
173

SEE ALSO

175       ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_eroute(5),
176       ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_spi(8), ipsec_version(5),
177       ipsec_pf_key(5)
178

HISTORY

180       Written for the Linux FreeS/WAN project <http://www.freeswan.org/> by
181       Richard Guy Briggs.
182

BUGS

184       The add and use times are awkward, displayed in seconds since machine
185       start. It would be better to display them in seconds before now for
186       human readability.
187
188
189
190[FIXME: source]                   10/06/2010                      IPSEC_SPI(5)
Impressum