Previously it was in ipsec statusall.

Now with swanctl I can only see swanctl --list-conns but it only shows the configuration details, not the runtime statistics: eg bytes transferred, negotiated ciphersuites, reauth/rekeying stats, and so on and so forth.

So, is there any similar command in the "new" strongswan configuration?

1 Answer 1


That's swanctl --list-sas, aka swanctl -l (with the lowercase L) for short:

star6: #1, ESTABLISHED, IKEv2, c87e1f22cf7e22a6_i* d3f4680ff0337849_r
  local  'ember.nullroute.lt' @ 2001:778:e27f:0:9618:82ff:fe38:e480[4500]
  remote 'star.nullroute.lt' @ 2a02:7b40:50d1:e466::1[4500]
  established 202176s ago, rekeying in 390602s
  gre: #7181, reqid 18, INSTALLED, TRANSPORT, ESP:AES_GCM_16-128
    installed 45150s ago, rekeying in 38337s, expires in 49890s
    in  c4b908f6,      0 bytes,     0 packets
    out c5d9c42b,    576 bytes,    12 packets,  2530s ago
    local  2001:778:e27f:0:9618:82ff:fe38:e480/128[gre]
    remote 2a02:7b40:50d1:e466::1/128[gre]

Though if you want to extract this for scripting, it is better to directly query via vici IPC than to parse swanctl output.

Some ESP/AH information can also be retrieved directly from the kernel, via ip xfrm policy and ip xfrm state (with the -s option to get statistics).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .