---
name: "ipsecctl"
section: "8"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["openbsd"]
url: "https://new.carta.tech/ipsecctl"
---

# ipsecctl(8)

control flows for IPsec

## NAME

**ipsecctl** – control flows for IPsec

## SYNOPSIS

**ipsecctl** \[**-cdFkmnv**\] \[**-D** *macro*=*value*\] \[**-f** *file*\] \[**-i** *fifo*\] \[**-s** *modifier*\]

## DESCRIPTION

The **ipsecctl** utility controls flows that determine which packets are to be processed by IPsec. It allows ruleset configuration, and retrieval of status information from the kernel's SPD (Security Policy Database) and SAD (Security Association Database). It also can control [isakmpd(8)](/isakmpd/8.md) and establish tunnels using automatic keying with [isakmpd(8)](/isakmpd/8.md). The ruleset grammar is described in [ipsec.conf(5)](/ipsec.conf/5.md).

The options are as follows:

- **-c**

  Use in combination with the **-s** option to collapse flow output.

- **-D** *macro*=*value*

  Define *macro* to be set to *value* on the command line. Overrides the definition of *macro* in the ruleset.

- **-d**

  When the **-d** option is set, specified flows will be deleted from the SPD. Otherwise, **ipsecctl** will add flows.

- **-F**

  The **-F** option flushes the SPD and the SAD.

- **-f** *file*

  Load the rules contained in *file*.

- **-i** *fifo*

  If given, the **-i** option specifies an alternate FIFO instead of */var/run/isakmpd.fifo*, used to talk to [isakmpd(8)](/isakmpd/8.md).

- **-k**

  Show secret keying material when printing the active SAD entries.

- **-m**

  Continuously display all PF\_KEY messages exchanged with the kernel.

- **-n**

  Do not actually load rules, just parse them.

- **-s** *modifier*

  Show the kernel's databases, specified by *modifier* (may be abbreviated):

  - **-s** **flow**

    Show the ruleset loaded into the SPD.

  - **-s** **sa**

    Show the active SAD entries.

  - **-s** **all**

    Show all of the above.

- **-v**

  Produce more verbose output. A second use of **-v** will produce even more verbose output.

## SEE ALSO

[ipsec(4)](/ipsec/4.md), [tcp(4)](/tcp/4.md), [ipsec.conf(5)](/ipsec.conf/5.md), [isakmpd(8)](/isakmpd/8.md)

## HISTORY

The **ipsecctl** program first appeared in OpenBSD 3.8.