3

I read a little bit on the Wikipedia IPsec page.

I was intrigued by:

IPsec is an end-to-end security scheme operating in the Internet Layer of the Internet Protocol Suite

I understand this as:

The packet sender and receiver can see the whole packet. Everyone along the way can see the IP header with the rest encrypted.

How would the underlying network be able to differentiate between UDP and TCP since they're at the transport layer.

Will we still have TCP and UDP when we move the IPv6 (although, I see that IPsec has been made optional for IPv6)?

Improve this question
7
  • 2
    Why would it need to differentiate between them? Network devices just need the IP header, and just forward the packet to the next hop (and take take 1 from ttl)
    – mulaz
    Jul 25, 2014 at 14:04
  • @mulaz I thought the network along the way use TCP for traffic congestion. And that it played a part in guaranteeing delivery
    – Cruncher
    Jul 25, 2014 at 14:21
  • 2
    End hosts usually deal with traffic congestion by reducing the transfer window, AIMD mechanism, etc. Middle hosts send ICMP Source Quench backs to transmitter if the buffer is full
    – Pedro Brito
    Jul 25, 2014 at 17:22
  • 3
    @PedroBrito ICMP source quench messages have been deprecated since 1995
    – Mike Pennington
    Jul 30, 2014 at 5:57
  • 2
    ECN is the only option for transit devices to notify endpoints of congestion, assuming tcp negotiated support for ECN during the connection open phase. TCP is expected to do the right thing if packets are dropped without ECN
    – Mike Pennington
    Jul 30, 2014 at 10:57

1 Answer 1

Reset to default
4

Assuming you mean to protect confidentiality of the communication at IP layer with IPsec:

How would the underlying network be able to differentiate between UDP and TCP since they're at the transport layer.

The next header field of the ESP header tells you the type of payload.

If you use tunnel mode (which is custom for VPNs), then without the necessary keys you cannot decide what's at transport layer because the next header field will tell you just that there's a whole IP packet encapsulated.

If you use transport mode, then the next header field tells you the type of payload at transport layer.

Will we still have TCP and UDP when we move the IPv6(Although I see that IPsec has been made optional for IPv6)?

TCP and UDP are agnostic to the layer-3 protocol. In fact, TCP and UDP (and SCTP and DCCP) exist also for IPv6.

What seems to puzzle you is that in IPsec tunnel (VPN) mode there is no way to inspect the content. This is supposed to happen at the tunnel end-points. An organization that is worried by this loss of control should not allow IPsec that is not under it's own control.

Further reading: An Illustrated Guide to IPsec

Improve this answer
1
  • The next-header field of the ESP trailer is also encrypted. You wouldn't be able to use that to determine whether the encrypted data is TCP or UDP. Even if you could read it, it would typically only tell you the next header was the original IP header (in tunnel mode at least, which is the predominant mode IPsec is used in).
    – Eddie
    Nov 12, 2015 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.