I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers have low cpu load during the tests. The vpn tunnel negotiation works fine, so no trouble there.

I'm thinking of doing a wireshark capture but I'm not quite sure what to look for there. Do I look for anything in particular when it comes to potential ipsec problems? What are typical signs to look for?

Appreciate your thoughts

  • 1
    If ethernet connection is working just fine I would check IP Fragmentation, MTU, MSS, PMTUD and crypto settings. Feb 8, 2017 at 15:20
  • I would also check if there are IP fragmentation problems. You say Ethernet connection is OK, but IPSec increases packet size, so potentially can cross MTU size.
    – Alex Levit
    Feb 23, 2017 at 6:42

1 Answer 1


Normally you would first check whether all packets are being encapsulated and decapsulated OK by viewing ipsec counters on the tunnel endpoints.

However if you want to look at packets, first you need to know whether or not low throughput is first caused by TCP effects, either packet loss or latency. That will influence where to look next. You need to see the traffic in the clear at either end of the tunnel if that's possible, not so easy if you are using transport mode, but I assume your "connection" is a tunnel, please confirm.

If you can capture packets at both ends of the tunnel and also the IPSec packets, it is relatively easy to match them, as IPSec has a fixed overhead for the tunnel depending upon ciphers used. You can then see where they are getting dropped or delayed.

  • Yes it's tunnel mode. Thanks for the answer..that will do for now.
    – rigor
    Feb 8, 2017 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.