I'm wondering if it is possible to Sniff IPSec connections.

At the beginning of a connection, the two peers agree on a SA and exchange a PSK or Certificates.

What I'm thinking about, is to intercept the SA-agreement. On the client-side, the attacker could act like the server, on the server-side the attacker could work like the client.

  • Thank you. I removed the parts with ssl-strip and described my idea in another way – 0xAffe Feb 26 '19 at 8:32
  • That's the point of PKI. You know which certificate to expect, and someone impersonating by presenting a certificate for which they do not posses private keys will fail during the negotiation. – vidarlo Feb 26 '19 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.