I'm trying to draw the packets in a network that uses an IPSec tunnel for security. More specifically: a laptop user using a public access point wants to query Google through an IPSec tunnel to a home PC. I'm trying to draw the packet between the laptop and the public access point.

If I understand it correctly the packets will have the following layout:

MacTo - MacFrom - IPSource - IPDestination - SourcePort - DestinationPort - [Encrypted source IP - Encrypted destination IP - Encrypted source port - Encrypted destination port - data]

in which the encrypted packet is placed between the brackets.

I'm wondering how to fill in the ports in this setting.

  • SourcePort: I assume just a random port of the laptop.
  • DestinationPort: I assume this is the port of the IPSec gateway service.
  • Encrypted source port: Is this the same as SourcePort? Is this port modified by the IPSec gateway before the packet is forwarded to Google?
  • Encrypted destination port: 80 (http for the Google request)

Can anyone confirm if my assumptions are correct or indicate how I should fill in "Encrypted source port"?

Thanks in advance

  • 4
    Why do you want to reinvent the wheel? An Illustrated Guide to IPsec Apr 18 '14 at 15:17
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8 '17 at 17:54

IPSEC has no ports. In IPv4 IPSEC, or to be more precise AH (authentication header) and ESP (encapsulation security payload), are two IP protocols just like TCP and UDP. In IPv6 IPSEC is part of the protocol are there are two extension headers one for authentication and one for encryption.

The only thing that has something to do with ports is IKE (Internet Key Exchange) protocol which uses UDP 500 or 4500.

  • 1
    Technically, ISAKMP uses UDP 500, and NAT-Traversal uses UDP 4500. IKE is simply the management program that calls for ISAKMP and IPsec to run and do their thing (and a few other programs like SKEME, OAKLEY, etc). IKEv2 also uses UDP 500 to be compatible with ISAKMP (used in IKEv1) deployments.
    – Eddie
    Apr 21 '14 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.