Ask Your Question
0

How do I configure Wireshare to decrypt AES-GCM ESP packets when there is no obvious way to configure the IV?

asked 2025-08-14 07:51:02 +0000

dgnis gravatar image

updated 2025-08-14 11:55:45 +0000

grahamb gravatar image

I would like to decrypt ESP packets using AES-GCM . Wireshark purports to support this algorithm and I can select it in the AES preferences menu however, while I can configure the key, there is no obvious provision to configure the Initialization Vector, without which the packets cannot be decrypted. How do I configure this value in Wireshark. I am using v4.4.7.

edit retag flag offensive close merge delete

Comments

Example configuration steps:
3444: ipsec: refactor the decryption and dissection of ESP packets

The sample captures and config data on Wiki: wiki:ipsec

Chuckc gravatar imageChuckc ( 2025-08-14 12:15:07 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2025-08-14 19:30:00 +0000

johnthacker gravatar image

That's the Neat Part, you don't.

Review RFC 4106. In AES-GCM for IPSec ESP the IV is included in each frame prior to the ciphertext. "For a given key, the IV MUST NOT repeat," so there would be no point in configuring it in Wireshark as it's right there in the packet payload.

If it's not decrypting for you, something else is the problem.

edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

subscribe to rss feed

Stats

Asked: 2025-08-14 07:51:02 +0000

Seen: 56 times

Last updated: 18 hours ago

Related questions

How can I save the payload of ESP as separate packet after decryption ?

Export decrypted ESP traffic to cap/pcap file

ESP - ISP - out of Sync / Lost packets

ESP VPN opnsense decrypt

Capture VoIP traffic through IPsec VPN

ESP traffic seen in clear with NULL encryption algorithm only if authentication is SHA1, not SHA256

Unable to decrypt ESP Payload in Wireshark 3.4.2

cannot capture secure packets

ESP packets are not displayed after changing protocol preference

Checksum (ESP ICV) with Extended Sequence Number (ESN)