I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication.

Is it not an inefficient use of sequence numbers as we are using the same number again and again? What is the need of this redundancy of sequence numbers?


Two numbers are needed because there is a many-to-one relationship between TCP streams (with separate TCP sequence numbers) and an IPsec tunnel (with its own sequence.)

Imagine a host with an IPsec VPN. It has two programs using the network: a web browser and a mail client. If there were only one sequence number, then either they would have to take turns making TCP connections through the tunnel, or they would each need a separately-configured IPsec tunnel for each TCP stream they establish.

The existing architecture ensures that multiple TCP, UDP, and other IP protocols can be multiplexed through a single IPsec tunnel.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.