In a book by Forouzan (https://www.amazon.com/Data-Communications-Networking-McGraw-Hill-Forouzan/dp/0072967757) I've read that the sequence number of the authentication header doesn't get repeated even if a packet is retransmitted.

If the sequence number is not repeated then I could potentially keep on sending same packets and receiver will think that they are different because they have different sequence numbers.

How does that prevent replay attack?

  • What protocol are we talking about and who or what is forouzan?
    – user36472
    Aug 23, 2017 at 17:11
  • Check the edit. It's a famous book so I thought people would know that.
    – Zephyr
    Aug 23, 2017 at 17:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19, 2018 at 17:47

1 Answer 1


The IPSec AH sequence number should not be confused with the TCP sequence number. They operate at different protocol layers.

If a host receives two packets with same AH signature (same sequence number) it definitely indicates a replay, and was not sent by the source host.

  • But how will same packets get same sequence no as they don't get repeated ?
    – Zephyr
    Aug 25, 2017 at 14:21
  • @Zephyr: You're saying they don't normally get repeated. But the point of replay protection is to guard against third parties maliciously doing so. Sep 11, 2017 at 7:02
  • @grawity, sorry I didn't get you. In the book it was given that sequence number don't get repeated . So I can keep on sending packets with different sequence number(replay attack). Now, how will receiver identify that I am doing replay attack because all the sequence no's are different and it will not be able to compare the sequence number of real and fradulent ones.
    – Zephyr
    Sep 11, 2017 at 12:14
  • 1
    @Zephyr: Isn't the sequence number authenticated by AH? That would mean you cannot fake the seq# without knowing the key. Sep 11, 2017 at 12:21
  • 1
    Because the IP/IPsec layer does not know the difference. Retransmits only exist at a higher layer (i.e. TCP), so as far as the IP layer is concerned, they're no different from brand new packets. Sep 11, 2017 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.