A sample for a super packet:
Create ESP-SA in your wireshark:
# This file is automatically generated, DO NOT MODIFY.
"IPv4","192.168.200.123","192.168.200.124","0x00000001","AES-CTR [RFC3686]","0x0123456789ABCDEFF1E0D3C2B5A4978600000001","HMAC-SHA-512-256 [RFC4868]","0x00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"
"IPv4","1.1.1.1","1.1.1.2","0x00000001","AES-CBC [RFC3602]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-MD5-96 [RFC2403]","0x00112233445566778899aabbccddeeff"
"IPv4","2.1.1.1","2.1.1.2","0x00000001","AES-CTR [RFC3686]","0x0123456789abcdeff1e0d3c2b5a4978600000001","HMAC-SHA-1-96 [RFC2404]","0x00112233445566778899aabbccddeeff00112233"
"IPv4","3.1.1.1","3.1.1.2","0x00000001","BLOWFISH-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-96 [draft-ietf-ipsec-ciph-sha-256-00]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","4.1.1.1","4.1.1.2","0x00000001","CAST5-CBC [RFC2144]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-128 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","5.1.1.1","5.1.1.2","0x00000001","DES-CBC [RFC2405]","0x0123456789abcdef","HMAC-SHA-384-192 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","6.1.1.1","6.1.1.2","0x00000001","TripleDES-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786fedcba9876543210","HMAC-SHA-512-256 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","7.1.1.1","7.1.1.2","0x00000001","TWOFISH-CBC","0x0123456789abcdeff1e0d3c2b5a49786","MAC-RIPEMD-160-96 [RFC2857]","0x00112233445566778899aabbccddeeff00112233"
"IPv6","2100::1:1:1:1","2100::1:1:1:2","0x00000001","AES-CBC [RFC3602]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-MD5-96 [RFC2403]","0x00112233445566778899aabbccddeeff"
"IPv6","2200::2:1:1:1","2200::2:1:1:2","0x00000001","AES-CTR [RFC3686]","0x0123456789abcdeff1e0d3c2b5a4978600000001","HMAC-SHA-1-96 [RFC2404]","0x00112233445566778899aabbccddeeff00112233"
"IPv6","2300::3:1:1:1","2300::3:1:1:2","0x00000001","BLOWFISH-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-96 [draft-ietf-ipsec-ciph-sha-256-00]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv6","2400::4:1:1:1","2400::4:1:1:2","0x00000001","CAST5-CBC [RFC2144]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-128 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv6","2600::6:1:1:1","2600::6:1:1:2","0x00000001","TripleDES-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786fedcba9876543210","HMAC-SHA-512-256 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv6","2700::7:1:1:1","2700::7:1:1:2","0x00000001","TWOFISH-CBC","0x0123456789abcdeff1e0d3c2b5a49786","MAC-RIPEMD-160-96 [RFC2857]","0x00112233445566778899aabbccddeeff00112233"
"IPv6","2500::5:1:1:1","2500::5:1:1:2","0x00000001","DES-CBC [RFC2405]","0x0123456789abcdef","HMAC-SHA-384-192 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
Open the following file in xcap:
# This file is automatically generated, DO NOT MODIFY.
"IPv4","192.168.200.123","192.168.200.124","0x00000001","AES-CTR [RFC3686]","0x0123456789ABCDEFF1E0D3C2B5A4978600000001","HMAC-SHA-512-256 [RFC4868]","0x00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"
"IPv4","1.1.1.1","1.1.1.2","0x00000001","AES-CBC [RFC3602]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-MD5-96 [RFC2403]","0x00112233445566778899aabbccddeeff"
"IPv4","2.1.1.1","2.1.1.2","0x00000001","AES-CTR [RFC3686]","0x0123456789abcdeff1e0d3c2b5a4978600000001","HMAC-SHA-1-96 [RFC2404]","0x00112233445566778899aabbccddeeff00112233"
"IPv4","3.1.1.1","3.1.1.2","0x00000001","BLOWFISH-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-96 [draft-ietf-ipsec-ciph-sha-256-00]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","4.1.1.1","4.1.1.2","0x00000001","CAST5-CBC [RFC2144]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-128 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","5.1.1.1","5.1.1.2","0x00000001","DES-CBC [RFC2405]","0x0123456789abcdef","HMAC-SHA-384-192 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","6.1.1.1","6.1.1.2","0x00000001","TripleDES-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786fedcba9876543210","HMAC-SHA-512-256 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv4","7.1.1.1","7.1.1.2","0x00000001","TWOFISH-CBC","0x0123456789abcdeff1e0d3c2b5a49786","MAC-RIPEMD-160-96 [RFC2857]","0x00112233445566778899aabbccddeeff00112233"
"IPv6","2100::1:1:1:1","2100::1:1:1:2","0x00000001","AES-CBC [RFC3602]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-MD5-96 [RFC2403]","0x00112233445566778899aabbccddeeff"
"IPv6","2200::2:1:1:1","2200::2:1:1:2","0x00000001","AES-CTR [RFC3686]","0x0123456789abcdeff1e0d3c2b5a4978600000001","HMAC-SHA-1-96 [RFC2404]","0x00112233445566778899aabbccddeeff00112233"
"IPv6","2300::3:1:1:1","2300::3:1:1:2","0x00000001","BLOWFISH-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-96 [draft-ietf-ipsec-ciph-sha-256-00]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv6","2400::4:1:1:1","2400::4:1:1:2","0x00000001","CAST5-CBC [RFC2144]","0x0123456789abcdeff1e0d3c2b5a49786","HMAC-SHA-256-128 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv6","2600::6:1:1:1","2600::6:1:1:2","0x00000001","TripleDES-CBC [RFC2451]","0x0123456789abcdeff1e0d3c2b5a49786fedcba9876543210","HMAC-SHA-512-256 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
"IPv6","2700::7:1:1:1","2700::7:1:1:2","0x00000001","TWOFISH-CBC","0x0123456789abcdeff1e0d3c2b5a49786","MAC-RIPEMD-160-96 [RFC2857]","0x00112233445566778899aabbccddeeff00112233"
"IPv6","2500::5:1:1:1","2500::5:1:1:2","0x00000001","DES-CBC [RFC2405]","0x0123456789abcdef","HMAC-SHA-384-192 [RFC4868]","0x00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
Open the following file in xcap:
super-packet.xcap | |
File Size: | 10 kb |
File Type: | xcap |
Right click the packet, click "View packet" menu item.