RFC2460 defines some extension headers, like hop-by-hop, Routing Options...etc. All these headers seem to have the next header type and header extension length in the beginning of the header.

However there is one extension header called "Encapsulating Security Payload" defined in RFC4303 seems don't have this property. The next header and pad length are followed by a variable data, so how can I parse that?


1 Answer 1


That is the IPsec ESP header, which encrypts its content. You can parse that if you have the decryption keys. Not being able to parse that content without having the right keys is the whole purpose of that header.

  • so if I have Upper layer packet format followed by ESP, I cannot parse that neither? since I don't have this ESP offset, right? Oct 1, 2015 at 8:51
  • Everything outside the ESP header is visible, everything inside is encrypted. And yes: that includes the upper layer header. Oct 1, 2015 at 8:52
  • You mean that ESP's payload data can include upper layer header? Oct 1, 2015 at 8:54
  • ESP payload always includes the upper layer header and its payload. That's it's purpose Oct 1, 2015 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.