I was going through a study of IPsec and I found that there are redundant sequence numbers: one in the AH or ESP header, and the other is in the TCP header for a communication.

Is it not an inefficient use of sequence numbers as we are using the same number again and again? What is the need of this redundancy of sequence numbers?

1 Answer 1


Two numbers are needed because there is a many-to-one relationship between TCP streams (with separate TCP sequence numbers) and an IPsec tunnel (with its own sequence.)

Imagine a host with an IPsec VPN. It has two programs using the network: a web browser and a mail client. If there were only one sequence number, then either they would have to take turns making TCP connections through the tunnel, or they would each need a separately-configured IPsec tunnel for each TCP stream they establish.

The existing architecture ensures that multiple TCP, UDP, and other IP protocols can be multiplexed through a single IPsec tunnel.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .