{"id":4392980,"date":"2024-03-01T22:09:00","date_gmt":"2024-03-01T22:09:00","guid":{"rendered":"https:\/\/www.lastopinion.io\/?p=4392980"},"modified":"2024-02-25T15:04:33","modified_gmt":"2024-02-25T15:04:33","slug":"how-to-decode-esp-packets-within-udp-encapsulation-using-wireshark","status":"publish","type":"post","link":"https:\/\/www.lastopinion.io\/index.php\/2024\/03\/01\/how-to-decode-esp-packets-within-udp-encapsulation-using-wireshark\/","title":{"rendered":"How to decode ESP packets within UDP encapsulation using Wireshark?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Have you ever found yourself in need of decrypting ESP packets nested within UDP encapsulation using Wireshark, especially when dealing with setups similar to those found in Cisco SD-WAN?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wireshark automatically performs this action for NAT-T UDP 4500 destination packets, but it require us to manually force it for other ports :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"322\" src=\"https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap3-1024x322.png\" alt=\"\" class=\"wp-image-4392985\" srcset=\"https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap3-980x308.png 980w, https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap3-480x151.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) 1024px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">So, simply right-click on the UDP packet, go to &#8220;Decode As,&#8221;  :<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1285\" height=\"799\" src=\"https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap2-1.png\" alt=\"\" class=\"wp-image-4392984\" style=\"width:495px;height:auto\" srcset=\"https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap2-1.png 1285w, https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap2-1-1280x796.png 1280w, https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap2-1-980x609.png 980w, https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap2-1-480x298.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) and (max-width: 1280px) 1280px, (min-width: 1281px) 1285px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">And choose &#8220;UDPEncap&#8221; to reveal ESP SPI and sequence numbers :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"520\" src=\"https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap-1024x520.png\" alt=\"\" class=\"wp-image-4392982\" srcset=\"https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap-980x498.png 980w, https:\/\/www.lastopinion.io\/wp-content\/uploads\/2024\/02\/Cisco_SD-WAN_UDPEncap-480x244.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) 1024px, 100vw\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Hope this helps!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.linkedin.com\/in\/mehdi-sfar-b4a42910\/\" target=\"_blank\" rel=\"noreferrer noopener\">Mehdi SFAR (CCDE 2021:3, CCIE #51583)<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Have you ever found yourself in need of decrypting ESP packets nested within UDP encapsulation using Wireshark, especially when dealing with setups similar to those found in Cisco SD-WAN? Wireshark automatically performs this action for NAT-T UDP 4500 destination packets, but it require us to manually force it for other ports : So, simply right-click [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4392990,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[18],"tags":[35,31,33,34,32],"class_list":["post-4392980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-encapsulation","tag-ipsec","tag-sd-wan","tag-tunnel","tag-udpencap"],"_links":{"self":[{"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/posts\/4392980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/comments?post=4392980"}],"version-history":[{"count":5,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/posts\/4392980\/revisions"}],"predecessor-version":[{"id":4392989,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/posts\/4392980\/revisions\/4392989"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/media\/4392990"}],"wp:attachment":[{"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/media?parent=4392980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/categories?post=4392980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lastopinion.io\/index.php\/wp-json\/wp\/v2\/tags?post=4392980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}