I have a specific environment in which TCP is not optimal due to its general assumptions, and thus needs to be improved. This small improvement has been done successfully. It operates at various layers, from 2 to 4, and needs read/write access to some information displayed in the TCP packets, such as the congestion window size. I was now wondering whether I could extend my proprietary protocol stack to operate with ipsec as well. The problem is that ipsec encrypts everything over ip, and I need rw access to some TCP values (not all of them). During the configuration time, I have root access to every component of the network (hosts, routers, ipsec implementations, ...), but during run time, only end hosts should be able to decrypt the whole payload. I am not a security expert, and I was wondering if you could help me to figure out what options were available for me to achieve that goal, without compromising too much the security (at least the payload).