Photuris
ICMP Type 40 Photuris carries security failure notifications for the Photuris session-key management protocol (RFC 2521). Codes indicate specific IPsec-layer failures: bad SPI, authentication failure, decompression failure, decryption failure, and authorization requirements. Rare in modern deployments.
Description
Photuris (RFC 2521) is a session-key management protocol for IPsec that predates IKE (Internet Key Exchange). ICMP Type 40 is used to report security-related failures when processing IP packets protected by IPsec.
Code 0 (Bad SPI) is sent when a packet arrives with a Security Parameter Index that is not recognized or has expired. Code 1 (Authentication Failed) indicates HMAC verification of an AH or ESP packet failed. Codes 2-3 cover decompression and decryption failures in IPsec traffic.
Photuris has been largely replaced by IKEv1 and IKEv2 for IPsec key management. However, the ICMP Type 40 codes remain defined and some IPsec implementations still generate them for diagnostic purposes. Type 40 messages are extremely rare on modern networks.
Common Causes
- –IPsec packet arrived with unrecognized or expired SPI (code 0)
- –IPsec AH or ESP authentication verification failed (code 1)
- –IPsec packet decompression failed (code 2)
- –IPsec ESP decryption failed (code 3)
- –IPsec SA requires authentication not present in packet (code 4)
Codes
| Code | Name |
|---|---|
| 0 | Bad SPI |
| 1 | Authentication Failed |
| 2 | Decompression Failed |
| 3 | Decryption Failed |
| 4 | Need Authentication |
| 5 | Need Authorization |