Re: What is freeswan doing when it is being stoped?

-----BEGIN PGP SIGNED MESSAGE-----

On Sun, Feb 09, 2003 at 09:41:54AM +0800, Vick Chen wrote:
> Dear RGB,
> 
> I am sorry to say that. I need your help because you are an expert on
> it. X.509 doesn't business about the problem, I think.
> 
> Here I try to descript the problem more clearly.
> 
> I compile Klips as a kernel module. Because we will do some jobs based
> on your great work - freeswan, so I now am analyzing source code of
> freeswan and do some testing on it.
> 
> And now, I have built a test bed as below:
> west ---- left-freeswan-GW =================== right-freeswan-GW ----
> east
> 
> I use PSK+ESP+Tunnel. And the tunnel was created successfully. Because I
> added some tracing codes into function ipsec_tunnel_start_xmit(), I
> found that when I restart or stop freeswan, a packet will be processed
> by ipsec_tunnel_start_xmit(). At this time, there is without normal
> communication between two gateways. And I can't find which one sends the
> packet. By tracing code, we can see it is always a UDP packet, and its
> source port is 15416, destination port is 10.
> 
> Can you tell me which module send the packet? Why?

IPsec uses protocol 50, ESP, and protocol 51, AH, to send traffic to a
remote system, using keys previously agreed upon.  If you are using IKE
automatic keying to negotiate keys for ESP or AH, it will use UDP port
500 as a source and destination unless some kind of NAT is being used,
in which case UDP port > 1024 may be used as a source port and UDP port
4500 may be used in the destination.

I don't know where you are getting UDP port 10.  It is not a common
service I have ever heard of.

Either you have a virus, trojan, or it is some feature of X.509 or some
other patch added to it, or some other service completely that you are
not telling us about.

> Thank you very much!
> 
> Vick

	slainte mhath, RGB

- -- 
Richard Guy Briggs        --    ~\                    Auto-Free Ottawa! Canada
<www.TriColour.net>         --    \@       @              <www.flora.org/afo/>
No Internet Wiretapping!     --   _\\/\%___\\/\%           Vote! -- <Green.ca>
<www.FreeSWAN.org>_______________(*)_______(*)(*)__________<www.Marillion.com>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBPkYBSd+sBuIhFagtAQHGNgQAqMy8tcN7zBxKslQQLLWwSW6P3KfPKYrW
fINcS2k/q2qMI6wVsxzvJJzIx+wC7cKlqM7dc51HvI47Rr6esxILSYm+cI5kealI
sGGvtLL8f+wProTmOw53TBiWeU2vMWboBiHlV4pFe71CUWDzNYa0hCCBbqN+1eL5
1vx92Fumdk8=
=OWg/
-----END PGP SIGNATURE-----