use ip xfrm with the detailed -s option