I'm trying to draw the packets in a network that uses an IPSec tunnel for security. More specifically: a laptop user using a public access point wants to query Google through an IPSec tunnel to a home PC. I'm trying to draw the packet between the laptop and the public access point.

If I understand it correctly the packets will have the following layout:

MacTo - MacFrom - IPSource - IPDestination - SourcePort - DestinationPort - [Encrypted source IP - Encrypted destination IP - Encrypted source port - Encrypted destination port - data]

in which the encrypted packet is placed between the brackets.

I'm wondering how to fill in the ports in this setting.

  • SourcePort: I assume just a random port of the laptop.
  • DestinationPort: I assume this is the port of the IPSec gateway service.
  • Encrypted source port: Is this the same as SourcePort? Is this port modified by the IPSec gateway before the packet is forwarded to Google?
  • Encrypted destination port: 80 (http for the Google request)

Can anyone confirm if my assumptions are correct or indicate how I should fill in "Encrypted source port"?

Thanks in advance

  • 4
    Why do you want to reinvent the wheel? An Illustrated Guide to IPsec Apr 18, 2014 at 15:17
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8, 2017 at 17:54
  • Whenever you use the term "port", it has to be in the context of some protocol, like TCP or UDP (because IP doesn't have ports, instead it has a protocol ID for the next header.) You have left TCP and UDP out of your list, so you can't talk about ports. In addition to listing fields, you have to show which header (ethernet, IP, ESP) the field is part of. Also, the answer to your question is different depending on whether you're using tunnel mode. (You can use an "IPsec tunnel" without being in "tunnel mode", and it's likely that's the case here.) Mar 31, 2023 at 14:56

1 Answer 1


IPSEC has no ports. In IPv4 IPSEC, or to be more precise AH (authentication header) and ESP (encapsulation security payload), are two IP protocols just like TCP and UDP. In IPv6 IPSEC is part of the protocol are there are two extension headers one for authentication and one for encryption.

The only thing that has something to do with ports is IKE (Internet Key Exchange) protocol which uses UDP 500 or 4500.

  • 2
    Technically, ISAKMP uses UDP 500, and NAT-Traversal uses UDP 4500. IKE is simply the management program that calls for ISAKMP and IPsec to run and do their thing (and a few other programs like SKEME, OAKLEY, etc). IKEv2 also uses UDP 500 to be compatible with ISAKMP (used in IKEv1) deployments.
    – Eddie
    Apr 21, 2014 at 20:48
  • Downvoted because "IPsec has no ports" is an overgeneralization. As explained by @eddie, IPsec uses port 4500 for NAT Traversal (and not just for IKE: the data path uses port 4500.) Mar 31, 2023 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.