# phpman > man > ip-xfrm(8) [IP-XFRM(8)](https://www.chedong.com/phpMan.php/man/IP-XFRM/8/markdown) Linux [IP-XFRM(8)](https://www.chedong.com/phpMan.php/man/IP-XFRM/8/markdown) ## NAME ip-xfrm - transform configuration ## SYNOPSIS **ip** [ _OPTIONS_ ] **xfrm** { _COMMAND_ | **help** } **ip** **xfrm** _XFRM-OBJECT_ { _COMMAND_ | **help** } _XFRM-OBJECT_ := **state** | **policy** | **monitor** **ip** **xfrm** **state** { **add** | **update** } _ID_ [ _ALGO-LIST_ ] [ **mode** _MODE_ ] [ **mark** _MARK_ [ **mask** _MASK_ ] ] [ **reqid** _REQID_ ] [ **seq** _SEQ_ ] [ **replay-window** _SIZE_ ] [ **replay-seq** _SEQ_ ] [ **replay-oseq** _SEQ_ ] [ **replay-seq-hi** _SEQ_ ] [ **replay-oseq-hi** _SEQ_ ] [ **flag** _FLAG-LIST_ ] [ **sel** _SELECTOR_ ] [ _LIMIT-LIST_ ] [ **encap** _ENCAP_ ] [ **coa** _ADDR_[/_PLEN_] ] [ **ctx** _CTX_ ] [ **extra-flag** _EXTRA-FLAG-_ _LIST_ ] [ **output-mark** _OUTPUT-MARK_ [ **mask** _MASK_ ] ] [ **if**___**id** _IF-ID_ ] [ **tfcpad** _LENGTH_ ] **ip** **xfrm** **state** **allocspi** _ID_ [ **mode** _MODE_ ] [ **mark** _MARK_ [ **mask** _MASK_ ] ] [ **reqid** _REQID_ ] [ **seq** _SEQ_ ] [ **min** _SPI_ **max** _SPI_ ] **ip** **xfrm** **state** { **delete** | **get** } _ID_ [ **mark** _MARK_ [ **mask** _MASK_ ] ] **ip** [ **-4** | **-6** ] **xfrm** **state** **deleteall** [ _ID_ ] [ **mode** _MODE_ ] [ **reqid** _REQID_ ] [ **flag** _FLAG-LIST_ ] **ip** [ **-4** | **-6** ] **xfrm** **state** **list** [ _ID_ ] [ **nokeys** ] [ **mode** _MODE_ ] [ **reqid** _REQID_ ] [ **flag** _FLAG-_ _LIST_ ] **ip** **xfrm** **state** **flush** [ **proto** _XFRM-PROTO_ ] ### ip xfrm state count _ID_ := [ **src** _ADDR_ ] [ **dst** _ADDR_ ] [ **proto** _XFRM-PROTO_ ] [ **spi** _SPI_ ] _XFRM-PROTO_ := **esp** | **ah** | **comp** | **route2** | **hao** _ALGO-LIST_ := [ _ALGO-LIST_ ] _ALGO_ _ALGO_ := { **enc** | **auth** } _ALGO-NAME_ _ALGO-KEYMAT_ | **auth-trunc** _ALGO-NAME_ _ALGO-KEYMAT_ _ALGO-TRUNC-LEN_ | **aead** _ALGO-NAME_ _ALGO-KEYMAT_ _ALGO-ICV-LEN_ | **comp** _ALGO-NAME_ _MODE_ := **transport** | **tunnel** | **beet** | **ro** | **in**___**trigger** _FLAG-LIST_ := [ _FLAG-LIST_ ] _FLAG_ _FLAG_ := **noecn** | **decap-dscp** | **nopmtudisc** | **wildrecv** | **icmp** | **af-unspec** | **align4** | **esn** _SELECTOR_ := [ **src** _ADDR_[/_PLEN_] ] [ **dst** _ADDR_[/_PLEN_] ] [ **dev** _DEV_ ] [ _UPSPEC_ ] _UPSPEC_ := **proto** { _PROTO_ | { **tcp** | **udp** | **sctp** | **dccp** } [ **sport** _PORT_ ] [ **dport** _PORT_ ] | { **icmp** | **ipv6-icmp** | **mobility-header** } [ **type** _NUMBER_ ] [ **code** _NUMBER_ ] | **gre** [ **key** { _DOTTED-QUAD_ | _NUMBER_ } ] } _LIMIT-LIST_ := [ _LIMIT-LIST_ ] **limit** _LIMIT_ _LIMIT_ := { **time-soft** | **time-hard** | **time-use-soft** | **time-use-hard** } _SECONDS_ | { **byte-soft** | **byte-hard** } _SIZE_ | { **packet-soft** | **packet-hard** } _COUNT_ _ENCAP_ := { **espinudp** | **espinudp-nonike** | **espintcp** } _SPORT_ _DPORT_ _OADDR_ _EXTRA-FLAG-LIST_ := [ _EXTRA-FLAG-LIST_ ] _EXTRA-FLAG_ _EXTRA-FLAG_ := **dont-encap-dscp** | **oseq-may-wrap** **ip** **xfrm** **policy** { **add** | **update** } _SELECTOR_ **dir** _DIR_ [ **ctx** _CTX_ ] [ **mark** _MARK_ [ **mask** _MASK_ ] ] [ **index** _INDEX_ ] [ **ptype** _PTYPE_ ] [ **action** _ACTION_ ] [ **priority** _PRIORITY_ ] [ **flag** _FLAG-_ _LIST_ ] [ **if**___**id** _IF-ID_ ] [ _LIMIT-LIST_ ] [ _TMPL-LIST_ ] **ip** **xfrm** **policy** { **delete** | **get** } { _SELECTOR_ | **index** _INDEX_ } **dir** _DIR_ [ **ctx** _CTX_ ] [ **mark** _MARK_ [ **mask** _MASK_ ] ] [ **ptype** _PTYPE_ ] [ **if**___**id** _IF-ID_ ] **ip** [ **-4** | **-6** ] **xfrm** **policy** { **deleteall** | **list** } [ **nosock** ] [ _SELECTOR_ ] [ **dir** _DIR_ ] [ **index** _INDEX_ ] [ **ptype** _PTYPE_ ] [ **action** _ACTION_ ] [ **priority** _PRIORITY_ ] [ **flag** _FLAG-LIST_] **ip** **xfrm** **policy** **flush** [ **ptype** _PTYPE_ ] ### ip xfrm policy count **ip** **xfrm** **policy** **set** [ **hthresh4** _LBITS_ _RBITS_ ] [ **hthresh6** _LBITS_ _RBITS_ ] _SELECTOR_ := [ **src** _ADDR_[/_PLEN_] ] [ **dst** _ADDR_[/_PLEN_] ] [ **dev** _DEV_ ] [ _UPSPEC_ ] _UPSPEC_ := **proto** { _PROTO_ | { **tcp** | **udp** | **sctp** | **dccp** } [ **sport** _PORT_ ] [ **dport** _PORT_ ] | { **icmp** | **ipv6-icmp** | **mobility-header** } [ **type** _NUMBER_ ] [ **code** _NUMBER_ ] | **gre** [ **key** { _DOTTED-QUAD_ | _NUMBER_ } ] } _DIR_ := **in** | **out** | **fwd** _PTYPE_ := **main** | **sub** _ACTION_ := **allow** | **block** _FLAG-LIST_ := [ _FLAG-LIST_ ] _FLAG_ _FLAG_ := **localok** | **icmp** _LIMIT-LIST_ := [ _LIMIT-LIST_ ] **limit** _LIMIT_ _LIMIT_ := { **time-soft** | **time-hard** | **time-use-soft** | **time-use-hard** } _SECONDS_ | { **byte-soft** | **byte-hard** } _SIZE_ | { **packet-soft** | **packet-hard** } _COUNT_ _TMPL-LIST_ := [ _TMPL-LIST_ ] **tmpl** _TMPL_ _TMPL_ := _ID_ [ **mode** _MODE_ ] [ **reqid** _REQID_ ] [ **level** _LEVEL_ ] _ID_ := [ **src** _ADDR_ ] [ **dst** _ADDR_ ] [ **proto** _XFRM-PROTO_ ] [ **spi** _SPI_ ] _XFRM-PROTO_ := **esp** | **ah** | **comp** | **route2** | **hao** _MODE_ := **transport** | **tunnel** | **beet** | **ro** | **in**___**trigger** _LEVEL_ := **required** | **use** **ip** **xfrm** **monitor** [ **all-nsid** ] [ **nokeys** ] [ **all** | _LISTofXFRM-OBJECTS_ ] _LISTofXFRM-OBJECTS_ := [ _LISTofXFRM-OBJECTS_ ] _XFRM-OBJECT_ _XFRM-OBJECT_ := **acquire** | **expire** | **SA** | **policy** | **aevent** | **report** ## DESCRIPTION xfrm is an IP framework for transforming packets (such as encrypting their payloads). This framework is used to implement the IPsec protocol suite (with the **state** object operating on the Security Association Database, and the **policy** object operating on the Security Policy Database). It is also used for the IP Payload Compression Protocol and features of Mobile IPv6. ip xfrm state add add new state into xfrm ip xfrm state update update existing state in xfrm ip xfrm state allocspi allocate an SPI value ip xfrm state delete delete existing state in xfrm ip xfrm state get get existing state in xfrm ip xfrm state deleteall delete all existing state in xfrm ip xfrm state list print out the list of existing state in xfrm ip xfrm state flush flush all state in xfrm ip xfrm state count count all existing state in xfrm _ID_ is specified by a source address, destination address, transform protocol _XFRM-PROTO_, and/or Security Parameter Index _SPI_. (For IP Payload Compression, the Compression Pa‐ rameter Index or CPI is used for _SPI_.) _XFRM-PROTO_ specifies a transform protocol: IPsec Encapsulating Security Payload (**esp**), IPsec Au‐ thentication Header (**ah**), IP Payload Compression (**comp**), Mobile IPv6 Type 2 Routing Header (**route2**), or Mobile IPv6 Home Address Option (**hao**). _ALGO-LIST_ contains one or more algorithms to use. Each algorithm _ALGO_ is specified by: • the algorithm type: encryption (**enc**), authentication (**auth** or **auth-trunc**), au‐ thenticated encryption with associated data (**aead**), or compression (**comp**) • the algorithm name _ALGO-NAME_ (see below) • (for all except **comp**) the keying material _ALGO-KEYMAT_, which may include both a key and a salt or nonce value; refer to the corresponding RFC • (for **auth-trunc** only) the truncation length _ALGO-TRUNC-LEN_ in bits • (for **aead** only) the Integrity Check Value length _ALGO-ICV-LEN_ in bits Encryption algorithms include **ecb(cipher**___**null)**, **cbc(des)**, **cbc(des3**___**ede)**, **cbc(cast5)**, **cbc(blowfish)**, **cbc(aes)**, **cbc(serpent)**, **cbc(camellia)**, **cbc(twofish)**, and **rfc3686(ctr(aes))**. Authentication algorithms include **digest**___**null**, **hmac(md5)**, **hmac(sha1)**, **hmac(sha256)**, **hmac(sha384)**, **hmac(sha512)**, **hmac(rmd160)**, and **xcbc(aes)**. Authenticated encryption with associated data (AEAD) algorithms include **rfc4106(gcm(aes))**, **rfc4309(ccm(aes))**, and **rfc4543(gcm(aes))**. Compression algorithms include **deflate**, **lzs**, and **lzjh**. _MODE_ specifies a mode of operation for the transform protocol. IPsec and IP Payload Com‐ pression modes are **transport**, **tunnel**, and (for IPsec ESP only) Bound End-to-End Tunnel (**beet**). Mobile IPv6 modes are route optimization (**ro**) and inbound trigger (**in**___**trig**‐‐ **ger**). _FLAG-LIST_ contains one or more of the following optional flags: **noecn**, **decap-dscp**, **nopmtudisc**, **wildrecv**, **icmp**, **af-unspec**, **align4**, or **esn**. _SELECTOR_ selects the traffic that will be controlled by the policy, based on the source ad‐ dress, the destination address, the network device, and/or _UPSPEC_. _UPSPEC_ selects traffic by protocol. For the **tcp**, **udp**, **sctp**, or **dccp** protocols, the source and destination port can optionally be specified. For the **icmp**, **ipv6-icmp**, or **mobility-** **header** protocols, the type and code numbers can optionally be specified. For the **gre** protocol, the key can optionally be specified as a dotted-quad or number. Other pro‐ tocols can be selected by name or number _PROTO_. _LIMIT-LIST_ sets limits in seconds, bytes, or numbers of packets. _ENCAP_ encapsulates packets with protocol **espinudp**, **espinudp-nonike**, or **espintcp**, using source port _SPORT_, destination port _DPORT_ , and original address _OADDR_. _MARK_ used to match xfrm policies and states _OUTPUT-MARK_ used to set the output mark to influence the routing of the packets emitted by the state _IF-ID_ xfrm interface identifier used to in both xfrm policies and states ip xfrm policy add add a new policy ip xfrm policy update update an existing policy ip xfrm policy delete delete an existing policy ip xfrm policy get get an existing policy ip xfrm policy deleteall delete all existing xfrm policies ip xfrm policy list print out the list of xfrm policies ip xfrm policy flush flush policies **nosock** filter (remove) all socket policies from the output. _SELECTOR_ selects the traffic that will be controlled by the policy, based on the source ad‐ dress, the destination address, the network device, and/or _UPSPEC_. _UPSPEC_ selects traffic by protocol. For the **tcp**, **udp**, **sctp**, or **dccp** protocols, the source and destination port can optionally be specified. For the **icmp**, **ipv6-icmp**, or **mobility-** **header** protocols, the type and code numbers can optionally be specified. For the **gre** protocol, the key can optionally be specified as a dotted-quad or number. Other pro‐ tocols can be selected by name or number _PROTO_. _DIR_ selects the policy direction as **in**, **out**, or **fwd**. _CTX_ sets the security context. _PTYPE_ can be **main** (default) or **sub**. _ACTION_ can be **allow** (default) or **block**. _PRIORITY_ is a number that defaults to zero. _FLAG-LIST_ contains one or both of the following optional flags: **local** or **icmp**. _LIMIT-LIST_ sets limits in seconds, bytes, or numbers of packets. _TMPL-LIST_ is a template list specified using _ID_, _MODE_, _REQID_, and/or _LEVEL_. _ID_ is specified by a source address, destination address, transform protocol _XFRM-PROTO_, and/or Security Parameter Index _SPI_. (For IP Payload Compression, the Compression Pa‐ rameter Index or CPI is used for _SPI_.) _XFRM-PROTO_ specifies a transform protocol: IPsec Encapsulating Security Payload (**esp**), IPsec Au‐ thentication Header (**ah**), IP Payload Compression (**comp**), Mobile IPv6 Type 2 Routing Header (**route2**), or Mobile IPv6 Home Address Option (**hao**). _MODE_ specifies a mode of operation for the transform protocol. IPsec and IP Payload Com‐ pression modes are **transport**, **tunnel**, and (for IPsec ESP only) Bound End-to-End Tunnel (**beet**). Mobile IPv6 modes are route optimization (**ro**) and inbound trigger (**in**___**trig**‐‐ **ger**). _LEVEL_ can be **required** (default) or **use**. ip xfrm policy count count existing policies Use one or more -s options to display more details, including policy hash table information. ip xfrm policy set configure the policy hash table Security policies whose address prefix lengths are greater than or equal policy hash table thresholds are hashed. Others are stored in the policy_inexact chained list. _LBITS_ specifies the minimum local address prefix length of policies that are stored in the Security Policy Database hash table. _RBITS_ specifies the minimum remote address prefix length of policies that are stored in the Security Policy Database hash table. ip xfrm monitor state monitoring for xfrm objects The xfrm objects to monitor can be optionally specified. If the **all-nsid** option is set, the program listens to all network namespaces that have a nsid assigned into the network namespace were the program is running. A prefix is displayed to show the network namespace where the message originates. Example: [nsid 1]Flushed state proto 0 ## AUTHOR Manpage revised by David Ward <> Manpage revised by Christophe Gouault <> Manpage revised by Nicolas Dichtel <> iproute2 20 Dec 2011 [IP-XFRM(8)](https://www.chedong.com/phpMan.php/man/IP-XFRM/8/markdown)