Home
Tools
IPsec / IKEv2 Step-Through

IPsec / IKEv2 Step-Through

A real Diffie-Hellman exchange with small numbers you can verify by hand, plus real traffic selector matching for Phase 2. Not a diagram, actual computed values.

Does this packet match the negotiated Security Association?

Phase 2 (Quick Mode in IKEv1, CREATE_CHILD_SA in IKEv2) negotiates which actual traffic gets protected. A traffic selector defines the allowed source/destination subnets, protocol, and port. Enter a packet below and see whether it would actually be encrypted under this SA or fall through in cleartext.

Negotiated Traffic Selector

Test Packet

Enter values above and check.