Shorewall users - Jul 2006 - Monitoring IPSEC traffic

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1






Forgive me as I''m late to the 2.6 kernel game. I have been, to this
point, still building my firewalls using the Fedora 1 - 2.4 kernel, Openswan
2.x, and using Shorewall 3.x

Now that I am using Fedora 5 - 2.6 kernel, the Ipsec0 interface no longer exists
(hence the change in Shorewall). This poses a problem in that I can no longer
monitor IPSEC tunnel traffic by doing a "tcpdump -n -i ipsec0".

How would one now monitor traffic traversing the IPSEC tunnel? I found this
ability to be very useful in troubleshooting.

I know this may not be the forum to ask this question, but any help, or pointers
would be appreciated.


			Joe




-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.6 (Build 6060)

iQA/AwUBRLUZggVMDrRdN8NGEQLXjwCfQjWAPz58S52ewzJoCpmOUSvjN+0AoIoU
sZDEOodHoL9EpJ0Aw25+PBW2
=TCL5
-----END PGP SIGNATURE-----




-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

HK4ME wrote:

> How would one now monitor traffic traversing the IPSEC tunnel? I found this
ability to be very useful in troubleshooting.
AFAIK, You will need to use address-based filtering:

	tcpdump -n i <external if> net <remote network>

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key




-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642