R: Re: R: Re: mtu issue with ipsec tunnel and netfilter snat

jengelh@inai.de wrote

On Thursday 2013-01-10 17:46, pupilla@libero.it wrote:

quoted

jengelh@inai.de wrote:

quoted

quoted

But why linux_gw_snat is not sending icmp need to frag packets to
10.148.12.23?

Perhaps because ICMP was blocked erroneously?

well, I don't see the icmp packets because tcpdump 'see' only the 
incoming ipsec clear packets. Is there a way to see the outgoing clear 
ipsec packets with tcpdump?

Not with AF_PACKET sockets (tcpdump uses such), but you could with 
iptables -j LOG, NFLOG and TRACE they can be made visible. If you need 
the full packet, you can either patch up LOG to call the kernel hexdump 
functions, or use NFLOG - I think - to deliver it to any userspace 
program to do further processing. If all else fails, there is also 
NFQUEUE with which the packet can also be copied to userspace.

Thanks for the reply.
I have saved the esp packets with tcpdump and then
decrypted with wireshark. Indeed, the icmp need to
frag packets are being sent by the linux ipsec
gateway.

Thanks for support.