Comments on: to IPComp or not to IPComp and…which Vendor http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html "You know my methods, Watson..." Thu, 09 Feb 2012 13:55:28 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: cristina_crow http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-7181 cristina_crow Fri, 29 Oct 2010 06:07:06 +0000 http://www.imacandi.net/windancer/?p=1603#comment-7181 @Kai: hey, glad you made it. Something else concerns me regarding your comments. They keep getting into the Spam folder. :( And I get A LOT of spam :-? I'll investigate. @Kai: hey, glad you made it. Something else concerns me regarding your comments. They keep getting into the Spam folder. :( And I get A LOT of spam :-? I’ll investigate.

]]> By: Kai http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-7168 Kai Thu, 28 Oct 2010 16:41:43 +0000 http://www.imacandi.net/windancer/?p=1603#comment-7168 Hi cristina, Thanks for quick reply, you are absolutely right, I was sent 72 bytes ping packet, and its too small for ipcomp. After increased the ping packets size, ipcomp header appears! Hi cristina,

Thanks for quick reply,

you are absolutely right, I was sent 72 bytes ping packet, and its too small for ipcomp. After increased the ping packets size, ipcomp header appears!

]]> By: cristina_crow http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-7167 cristina_crow Thu, 28 Oct 2010 16:05:44 +0000 http://www.imacandi.net/windancer/?p=1603#comment-7167 @Kai: hello, sorry for replying this late. I am at a customer site, so I have rare access to the Internet. Besides that, my "smart" Akismet plugin reported your comments as Spam :| So, getting back to the topic: I don't remember exactly the details, but I guess you should have a larger packet to make sure the compression kicks in - like I've said, I don't remember the details :( Buuut, you should also verify running the "ipsec status" command whether that particular SA has a "comp" in its description, like mine says: 000 #3: “network1″ STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 2488s; newest IPSEC; eroute owner 000 #3: “network1″ esp.525b0b48@192.168.0.10 (0 bytes) esp.5511d8c2@192.168.0.1 (0 bytes) comp.1169@192.168.0.10 comp.527e@192.168.0.1; transport @Kai: hello, sorry for replying this late. I am at a customer site, so I have rare access to the Internet. Besides that, my “smart” Akismet plugin reported your comments as Spam :|

So, getting back to the topic: I don’t remember exactly the details, but I guess you should have a larger packet to make sure the compression kicks in – like I’ve said, I don’t remember the details :(

Buuut, you should also verify running the “ipsec status” command whether that particular SA has a “comp” in its description, like mine says:
000 #3: “network1″ STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 2488s; newest IPSEC; eroute owner
000 #3: “network1″ esp.525b0b48@192.168.0.10 (0 bytes) esp.5511d8c2@192.168.0.1 (0 bytes) comp.1169@192.168.0.10 comp.527e@192.168.0.1; transport

]]> By: Kai http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-7164 Kai Thu, 28 Oct 2010 14:49:19 +0000 http://www.imacandi.net/windancer/?p=1603#comment-7164 where is my comment? Thanks where is my comment?

Thanks

]]> By: Kai http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-7162 Kai Thu, 28 Oct 2010 13:56:22 +0000 http://www.imacandi.net/windancer/?p=1603#comment-7162 i have a very close setup as you have there, expect authby=rsasig. I'm using patched wireshark to capture my ping packets, but I can't see IPcomp header followed after esp head in the trace, am I miss something? Thanks i have a very close setup as you have there, expect authby=rsasig.
I’m using patched wireshark to capture my ping packets, but I can’t see IPcomp header followed after esp head in the trace, am I miss something?

Thanks

]]> By: Kai http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-7160 Kai Thu, 28 Oct 2010 13:54:18 +0000 http://www.imacandi.net/windancer/?p=1603#comment-7160 i have a very close setup as you have there, expect authby=rsasig. I'm using patched wireshark to capture my ping packets, but I can't see IPcomp header followed after esp head in the trace, any hint? Thanks i have a very close setup as you have there, expect authby=rsasig.
I’m using patched wireshark to capture my ping packets, but I can’t see IPcomp header followed after esp head in the trace, any hint?

Thanks

]]> By: cristina_crow http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-3692 cristina_crow Sat, 06 Feb 2010 13:26:36 +0000 http://www.imacandi.net/windancer/?p=1603#comment-3692 @vmp: ha! that's what I was searching for :d Thanks @vmp: ha! that’s what I was searching for :d Thanks

]]> By: vmp http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-3690 vmp Sat, 06 Feb 2010 13:19:14 +0000 http://www.imacandi.net/windancer/?p=1603#comment-3690 NetCocoon? You could have used Wireshark. As for decompressing IPcomp, https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4149 NetCocoon? You could have used Wireshark.

As for decompressing IPcomp, https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4149

]]> By: cristina_crow http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-3688 cristina_crow Sat, 06 Feb 2010 12:18:40 +0000 http://www.imacandi.net/windancer/?p=1603#comment-3688 @Andreas: woooooww..Andreas Steffen on my blooggg WOOOOWWWWWW. Such on honor. WOOOW ^:)^ I will try the new fix. I know you were working on it, but..to actually have you sending me the link to the new fix here. Woow. @Andreas: woooooww..Andreas Steffen on my blooggg WOOOOWWWWWW. Such on honor. WOOOW ^:)^ I will try the new fix. I know you were working on it, but..to actually have you sending me the link to the new fix here. Woow.

]]> By: Andreas Steffen http://www.imacandi.net/windancer/2010/02/05/to-ipcomp-or-not-to-ipcomp-and-which-vendor.html/comment-page-1#comment-3687 Andreas Steffen Sat, 06 Feb 2010 11:58:17 +0000 http://www.imacandi.net/windancer/?p=1603#comment-3687 We recently fixed the ESP encapsulation of IPComp in the IKEv2 strongSwan daemon: http://wiki.strongswan.org/repositories/revision/strongswan/2b2c69e992d5e279ecde7d3ebf20804d59b8bf0d You can try the current release candidate: http://download.strongswan.org/strongswan-4.3.6rc1.tar.bz2 Andreas We recently fixed the ESP encapsulation of IPComp in the IKEv2 strongSwan daemon:

http://wiki.strongswan.org/repositories/revision/strongswan/2b2c69e992d5e279ecde7d3ebf20804d59b8bf0d

You can try the current release candidate:
http://download.strongswan.org/strongswan-4.3.6rc1.tar.bz2

Andreas

]]>