Decrypting ESP packet using Wireshark

Only for educational purposes!!!

I am sure that you will be excited with this topic. Yes in this article we are going to see how to decrypt a ESP packet using Wireshark, before getting into Decrypting ESP packet we need to look into how IPSec VPN works

In general IPSec VPN, we have Phase I and Phase II, where the Phase I tunnel is used to securely negotiate the Phase II parameters and the data is transmitted over Phase II tunnel. The Phase I uses pre-shared authentication and not limited to it, Phase II uses the DH group (Diffie Hellman). DH creates a dynamic symmetric key and we don't have any clue of what it is to decrypt the ESP packet.



So in this article we are going negotiate a IPSec VPN tunnel with Manual Key.

In Manual Key IPSec VPN there are no Phase 1 or Phase 2 negotiations, each side can just start sending the data once the tunnel is negotiated with user defined IPSec keys. Of course, both sides must be configured appropriately, else the data will be dropped by either side.

Now lets configure the Manual Key IPSec VPN as per the topology 1.1 and capture the ESP packet.

Topology 1.1

R1 Config

crypto ipsec transform-set spiceup esp-des esp-sha-hmac
!
crypto map testmap 1 ipsec-manual
set peer 3.3.3.2
set session-key inbound esp 1001 cipher 6162636465666768 authenticator 616263646566676869707172737475767778797A
set session-key outbound esp 1000 cipher 6162636465666768 authenticator 616263646566676869707172737475767778797A
set transform-set spiceup
match address 100
!
interface Loopback1
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
ip address 2.2.2.1 255.255.255.252
duplex auto
speed auto
crypto map testmap
!
ip route 0.0.0.0 0.0.0.0 2.2.2.2
!
access-list 100 permit ip host 1.1.1.1 host 4.4.4.1

R2 Config

interface FastEthernet0/0
ip address 2.2.2.2 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 3.3.3.1 255.255.255.252
duplex auto
speed auto

R3 Config

crypto ipsec transform-set spiceup esp-des esp-sha-hmac
!
crypto map testmap 1 ipsec-manual
set peer 2.2.2.1
set session-key inbound esp 1000 cipher 6162636465666768 authenticator 616263646566676869707172737475767778797A
set session-key outbound esp 1001 cipher 6162636465666768 authenticator 616263646566676869707172737475767778797A
set transform-set spiceup
match address 100
!
interface Loopback1
ip address 4.4.4.1 255.255.255.255
!
interface FastEthernet0/0
ip address 3.3.3.2 255.255.255.252
duplex auto
speed auto
crypto map testmap
!
ip route 0.0.0.0 0.0.0.0 3.3.3.1
!
access-list 100 permit ip host 4.4.4.1 host 1.1.1.1

Now start the capture on R2 router on fe0/1 interface.

Start Capture in GNS3

Start the Wireshark on R2 router fe0/1 interface.

Start Wireshark in GNS3

Now lets do a ping from 1.1.1.1 to 4.4.4.1 and this packets will be captured by Wireshark which we are running on R2 router on fe0/1 interface.

R1#ping 4.4.4.1 source 1.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.1, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/84/92 ms

Take a closer look the echo-request packet from 1.1.1.1 to 4.4.4.1 and echo-reply packet from 4.4.4.1 to 1.1.1.1 are not visible on Wireshark, it is encapsulated with ESP with the source & destination IP as the Peer IP address. Now lets decrypte it.

Navigate to edit => preferences => protocol => ESP

Select the check box "Attempt to detect/decode encrypted ESP payload"
Click on Edit in "ESP SA" and click on New

Enter the source & destination peer IP address, SPI, encryption & authentication algorithm, encryption & authentication key as per our configuration for both the directions as mentioned below.

you might me wondering because the encryption & authentication key which we used in configuration are 6162636465666768 and 616263646566676869707172737475767778797A but the key entered in Wireshark is abcdefgh & abcdefghipqrstuvwxyz don't be worried. The key entered in device is in Hexa decimal format and the Key entered in Wireshare is in ASCI format. (Hexa to ASCI table is show below) 

[Note: It is not mandatory to enter the "authentication key" in Wireshark to decrypt the packet, but if you wish you can enter it]

Click on Ok and now you can see the packet is decrypted :-)

You can download the packet capture used in the lab and enter the same parameters in Wireshark to decrypt the packet.

Hexa decimal to ASCI

Leave your comment below