Hack the Route Start free Open app Services and tunnels
ip xfrm
Shows the kernel's IPsec tables: the policies that pick what goes into a tunnel, and the SAs that encrypt it.
IPsec's packets are encrypted by the kernel, not by the IKE daemon. ip xfrm policy lists what is protected:
source and destination networks, a direction (out, in, fwd) and a template naming the tunnel's two ends.
ip xfrm state lists the SAs, one per direction, each with its SPI, mode, algorithm and key. ip -s xfrm state adds counters.
ip xfrm command usage
ip xfrm policy ip [-s] xfrm state
Options
-
policy - what traffic is protected, and by which tunnel
-
state - the security associations: SPIs, algorithms and keys
-
-s - with counters
ip xfrm examples
-
ip xfrm policy | grep -A3 'dst 10.0.4.0/24' - Shows how traffic to the branch's network is protected.
-
ip xfrm state - Lists every SA with its SPI and algorithm.
Pitfalls
- The keys are printed in full: on real gear, whoever reads this output can decrypt the tunnel.