A table entry consists of:
Addresses are written as IPv4 dotted quads, protocol is one of "ah", "esp" or "tun" and SPIs are '0x'-prefixed hexadecimal numbers
SAIDs are written as "proto0xSPI@edst".
172.31.252.0/24 -> 0.0.0.0/0 => tun0x130@192.168.43.1
means that an eroute has been set up to protect traffic between the subnet 172.31.252.0 with a subnet mask of 24 bits and the default address/mask represented by an address of 0.0.0.0 with a subnet mask of 0 bits using the local machine as a security gateway on this end of the tunnel and the machine 192.168.43.1 on the other end of the tunnel with a Security Association IDentifier of tun0x130@192.168.43.1 which means that it is a tunnel mode connection (4, IPPROTO_IPIP) with a Security Parameters Index of 130 in hexadecimal.
192.168.6.0/24 -> 192.168.7.0/24 => %passthrough
means that an eroute has been set up to pass the traffic from the subnet 192.168.6.0 with a subnet mask of 24 bits and to subnet 192.168.7.0 with a subnet mask of 24 bits without any IPSEC processing.
192.168.2.110/32 -> 192.168.2.120/32 =>
esp0xe6de@192.168.2.120
means that an eroute has been set up to protect traffic between the host 192.168.2.110 and the host 192.168.2.120 using 192.168.2.110 as a security gateway on this end of the connection and the machine 192.168.2.120 on the other end of the connection with a Security Association IDentifier of esp0xe6de@192.168.2.120 which means that it is a transport mode connection with a Security Parameters Index of e6de in hexadecimal using Encapsuation Security Payload protocol (50, IPPROTO_ESP).