Manpage of IPSEC_SPI
Section: File Formats (5)
Updated: 26 Jun 2000
Return to Main Contents
ipsec_spi - list IPSEC Security Associations
is a read-only file that lists the current IPSEC Security Associations.
A Security Association (SA) is a transform through which packet contents
are to be processed before being forwarded. A transform can be an
IP-in-IP encapsulation, an IPSEC Authentication Header (authentication
with no encryption), or an IPSEC Encapsulation Security Payload
(encryption, possibly including authentication).
When a packet is passed from a higher networking layer through an IPSEC
virtual interface, a search in the extended routing table (see
a IP protocol number
a Security Parameters Index (SPI)
an effective destination address
When an IPSEC packet arrives from the network,
its ostensible destination, an SPI and an IP protocol
specified by its outermost IPSEC header are used.
The destination/SPI/protocol combination is used to select a relevant SA.
for discussion of how multiple transforms are combined.)
arguments specify an SAID.
is an ASCII string, "ah", "esp" or "tun", specifying the IP protocol.
is a number, preceded by '0x' indicating hexadecimal,
where each hexadecimal digit represents 4 bits,
is a dotted-decimal IPv4 destination address.
combines the three parameters above, such as: "firstname.lastname@example.org"
A table entry consists of:
<transform name (proto,encalg,authalg)>:
initialisation vector length and value (iv_bits=, iv=) if non-zero
out-of-order window size, number of out-of-order errors, sequence
number, recently received packet bitmask, maximum difference between
sequence numbers (ooowin=, ooo_errs=, seq=, bit=, max_seq_diff=) if SA
is AH or ESP and if individual items are non-zero
extra flags (flags=) if any are set
authenticator length in bits (abit=) if non-zero
authentication key length in bits (key_bits_a=) if non-zero
authentication errors (auth_errs=) if non-zero
encryption key length in bits (key_bits_e=) if non-zero
encryption size errors (encsize_errs=) if non-zero
encryption padding error warnings (encpad_errs=) if non-zero
source and destination addresses, as dotted-quads, separated by '->',
for IPIP SAs only
lifetimes legend, c=current, s=soft limit, h=hard limit (life(c,s,h)=)
number of connections to which the SA is allocated (alloc=), if any
value is non-zero
number of bytes processesd by this SA (bytes=), if any value is
time since machine bootup when the SA was added, in seconds (add=)
time since machine bootup when the SA was first used, in seconds (used=),
if any value is non-zero
number of packets processesd by this SA (packets=), if any value is
time since the last packet was processed, in seconds (idle=), if SA has
email@example.com IPIP: dir=out
192.168.43.2 -> 192.168.43.1
is an outbound IPIP (protocol 4) tunnel-mode SA set up between machines
192.168.43.2 and 192.168.43.1 with an SPI of 12a in hexadecimal that has
passed 628 kilobytes of traffic in 7031 packets since it was created,
850 kiloseconds after machine startup, first used 104 seconds after that
and has been idle for 23 seconds.
dir=in ooowin=32 seq=7149 bit=0xffffffff
alen=128 aklen=128 eklen=192
is an inbound Encapsulating Security Payload (protocol 50) SA on machine
192.168.43.2 with an SPI of 9a35fc02 that uses 3DES as the encryption
cipher, HMAC MD5 as the authentication algorithm, an out-of-order
window of 32 packets, a present sequence number of 7149, every one of
the last 32 sequence numbers was received, the authenticator length and
keys is 128 bits, the encryption key is 192 bits (actually 168 for 3DES
since 1 of 8 bits is a parity bit), has passed 1.2 Mbytes of data in
7149 packets, was added 850 kiloseconds after machine boot, first used
104 seconds after that and has been idle for 23 seconds.
ipsec(8), ipsec_manual(8), ipsec_tncfg(5), ipsec_eroute(5),
ipsec_spigrp(5), ipsec_klipsdebug(5), ipsec_spi(8), ipsec_version(5),
Written for the Linux FreeS/WAN project
by Richard Guy Briggs.
The add and use times are awkward, displayed in seconds since machine
start. It would be better to display them in seconds before now for
- SEE ALSO
This document was created by
using the manual pages.
Time: 02:46:48 GMT, July 02, 2000