Re: Isakmp and Snort?

[newsham@lava.net (Tim Newsham)]

> Hi All,
> 
> Now I want to detect the packets information between two VPN gateways with
> Snort. After I setting up isakmpd, the Snort only can catch UDP packets during
> phase 1 and have got nothing of ESP or AH packects. As far as I know, Snort
> can detect TCP/UDP/ICMP. How about ESP and AH? If it can, how to write the
> rules of Snort? I will appreciate your help or hints.

If you want to look at the un-encrypted traffic, you can
do so on the gateway itself by sniffing the enc0 interface.
You will have to make sure snort parses through the encapsulated
ip packet though since the packets will have an extra header
on them.

If you are trying to look at the traffic from a different
machine, it will be encrypted and you wont be able to decrypt
it without knowing the algorithm and the key.  You would
have to modify the gateway to leak this information to your
snort machine and modify the snort host to decode the
encrypted traffic.

> Thanks!
> Jack

Tim N.