DSADD(8)

NAME
dsadd - Dead Security Association Detection Daemon

SYNOPSIS
dsadd [-c number] [-i time] [-P priorify] [-LESd]

DESCRIPTION
dsadd detects and deletes the dead security association. dsadd searches the security association database in the kernel periodically, then sends ICMP echo requests to the peer of each SA. if any ICMP echo reply won't be back, dsadd will delete the SA immediately.

-c  specify the number of icmp echo packet to be sent. default is 2 times.

-i  (a) if the current round takes more than the specified time in seconds the next round will start immediately after the current will finish. (b) otherwise the next will start after the specified time from the current first check. default is 300 seconds.

        (a)
        +----- first round -----+---- second round --...
        +-- specified time --+
        (b)
        +----- first round -----+      +---- second round --...
        +------- specified time -------+

-P  specify the priority used by logger(1). default is " user.notice ".

-L  force to check only once.

-E  don't delete the SA even if the SA looks dead.

-S  don't tell syslog(8) what the SA has been deleted.

-d  debug mode.

SEE ALSO
logger(1), setkey(8), syslogd(8)

BUGS
dsadd can only detect the dead SAs which based an IP address. For example, when the SA is only for a TCP session, dsadd cannot detect if the SA is dead or alive because dsadd uses ICMP packets. the peer sends back a response even if the SA is dead.