---
name: "vde_cryptcab"
section: "1"
platform: "linux"
package: "vde2"
version: "2.3.3-10"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/vde_cryptcab"
---

# vde\_cryptcab(1)

Virtual Distributed Ethernet encrypted cable manager

## NAME

vde\_cryptcab - Virtual Distributed Ethernet encrypted cable manager

## SYNOPSIS

**vde\_cryptcab** \[  **-p** *portnum* \]  \[  **-s** *socketpath* \]  \[  **-c** *\[remote\_user@\]host\[:remote\_portnum\]* \]  \[  **-P** *pre\_shared.key* \]\| \[ **-x** \]  \[ **-v** *\[v\]\[v\]\[v\]* \]  \[ **-k** \] \[ **-d** \]\

## DESCRIPTION

A **vde\_cryptcab**  is a distributed cable manager for VDE switches. It allows two VDE switches on two machines to communicate using a ChaCha encrypted channel.

When used in client mode (i.e., with -c option), it generates a random ChaCha key, and uses **scp (1)** to transfer the key to the remote server.

On the client side, the environment variable SCP\_EXTRA\_OPTIONS may be set in order  to append options to the scp command line (this is useful for example when dropbear or another non-standard ssh client is used to transfer the ChaCha key).

After a 4-way handshake phase to verify client credentials, server and  client will exchange VDE datagrams encapsulating them into cryptograms that are sent via udp to each remote host.

On server side, one could run:

**vde\_cryptcab -s /tmp/vde2.ctl -p 2100**

To start a multi-peer cryptcab server, accepting udp datagrams on port 2100, that connects each authenticated remote client to a different  port of the switch. In fact, a new instance of  **vde\_plug (1)** is started and connected to the switch through local unix socket.

The command

**vde\_cryptcab -s /tmp/vde2.ctl -c foo@remote.machine.org:2100**

will connect a client to the remote server, running on udp port 2100. At this point, on server side a verify for user "foo" credentials is required,  typically it could be: host-based authentication, password challenge  or public key authentication. See **ssh (1)** for more details about it.

If the two vde\_switches run as daemon and they are connected to tap interfaces a level 2 encrypted tunnel is established.

## OPTIONS

- **-p *portnum***

  It is possible to decide which local udp port to use. When this option is not specified, cryptcab will use default udp port number, 7667.

- **-c *\[remote\_user@\]host\[:remote\_portnum\]***

  run vde\_cryptcab in client mode, trying to connect to  **host .** Both  **remote\_user** and  **remote\_portnum** parameters are not required. If not specified, the same user running vde\_cryptcab is used for authentication on server, and default udp port 7667 is used.

- **-s *socketpath***

  specify the UNIX socket to be used by local programs for joining the VDE. The default value is "/tmp/vde.ctl".

- **-P *pre\_shared.keypath***

  if specified, vde\_cryptcab will run in pre-shared key mode, instead of generating a random key to transmit with ssh. Given option is the path to the pre-shared symmetric key file to use for data encryption. The same key has to be used on both client and server.

- **-x**

  Disable symmetric key encryption.

- **-k**

  Send periodic "keepalive" packets to avoid server timeouts. Useful when you want to keep a low-traffic link available.

- **-d**

  Run as daemon.

- **-v**

  Verbose. (Use -vv -vvv or -vvvv for more verbosity)

## KNOWN ISSUES

Encapsulating IP packets into session+udp layer results in real datagrams larger than tap device mtu. Since vde\_cryptcab gets confused by packet fragmentation, the  tap device mtu must be set to a smaller value than real interface mtu. Use  [**ip**(8)](/ip/8.md) or  [**ifconfig**(8)](/ifconfig/8.md) to set up your tap device mtu.

Explicitly disabling encryption leads to obvious security problems. It is advised to avoid unencrypted mode (-x) in non-controlled networks.

## NOTICE

Virtual Distributed Ethernet is not related in any way with www.vde.com ("Verband der Elektrotechnik, Elektronik und Informationstechnik" i.e. the German "Association for Electrical, Electronic & Information Technologies").

## SEE ALSO

[**vde\_switch**(1)](/vde_switch/1.md), [**vdeq**(1)](/vdeq/1.md), [**vde\_plug**(1)](/vde_plug/1.md), [**vde\_plug2tap**(1)](/vde_plug2tap/1.md), [**scp**(1)](/scp/1.md), [**ssh**(1)](/ssh/1.md).\

## AUTHORS

VDE is a project by Renzo Davoli \<renzo@cs.unibo.it\>.

vde\_cryptcab is a VDE component by Daniele Lacamera \<root@danielinux.net\>