ENC(4)                    OpenBSD Programmer's Manual                   ENC(4)

NAME
     enc - Encapsulating Interface

SYNOPSIS
     pseudo-device enc 4

DESCRIPTION
     The enc interface is a software loopback mechanism that allows hosts or
     firewalls to filter ipsec(4) traffic using ipf(5). The vpn(8) manpage
     shows an example of such a setup.

     Another use is to allow the creation of virtual-Ethernets, using
     ipsec(4). See bridge(4) and ipsecadm(8) for more details. Briefly, enc
     interfaces can be part of a bridge configuration.  Such interfaces are
     treated as Ethernet interfaces; packets sent to them by the bridge are
     IPsec-processed and sent to the remote bridge (which reverses the process
     and injects the original Ethernet frames in the local Ethernet segments).
     Packets received with the appropriate IPsec SA are made to appear as if
     they arrived over the corresponding enc interface, and are then processed
     by the bridge accordingly.  ifconfig(8) is used to associate an enc in-
     terface with an IPsec SA.  Note that the ``enc0'' interface may not be
     used in a bridge configuration.

     If the IFF_LINK0 flag is set on an enc interface, IP-in-IP encapsulation
     (instead of Ethernet-in-IP) is done.  Its use is currently experimental.
     This flag should not be set when the interface is used in conjunction
     with the bridge.

     The last use of the enc interface is to allow an administrator to see
     outgoing packets before they have been processed by ipsec(4), or incoming
     packets after they have been similarly processed, via tcpdump(1).

     The ``enc0'' interface inherits all the IPsec traffic that does not have
     another enc interface explicitly assigned to it. Thus, if one were never
     to assign an IPsec SA to another enc interface, all IPsec traffic could
     be filtered based on ``enc0'', and all IPsec traffic could be seen by in-
     voking tcpdump(1) on the ``enc0'' interface.  IPsec SAs that have been
     assigned to some other enc interface can be snooped via tcpdump(1) or
     filtered via ipf(5) through that enc interface.

EXAMPLES
     To see all outgoing packets before they have been processed via ipsec(4),
     or all incoming packets after they have been similarly processed:

     #> ifconfig enc0 up
     #> tcpdump -i enc0

SEE ALSO
     tcpdump(1), bpf(4), inet(4), ipsec(4), netintro(4), ipf(5), vpn(8)

BUGS
     The PROMISC flag is not cleared on the enc0 interface after tcpdump is
     stopped.

OpenBSD 2.8                     October 7, 1999                              1
