I am using ip xfrm state and ip xfrm policy commands from iproute2 tool to implement IPSec. I have read documentation of iproute2 (PDF) and ip-xfrm man page. The man page states:


LIMIT := { time-soft | time-hard | time-use-soft | time-use-hard } SECONDS | { byte-soft | byte-hard } SIZE | { packet-soft | packet-hard } COUNT

LIMIT-LIST sets limits in seconds, bytes, or numbers of packets.

Unfortunately, I couldn't find any documentation which explains the difference between time-soft vs time-hard and time-use-soft vs time-use-hard. Can anyone please explain these LIMIT types or any documentation reference ?

  • What kind of additional information do you need?
    – ecdsa
    Commented Jul 9, 2015 at 8:13
  • @ecdsa sorry for delayed response, what is need for soft limit? I can have timer in my keying daemon, which can trigger event to rekey according to expire time without having soft limit.
    – Zaksh
    Commented Aug 15, 2015 at 14:47
  • I've updated my answer.
    – ecdsa
    Commented Aug 17, 2015 at 8:54

1 Answer 1


The soft limits can be used to implement rekeying. If either limit is reached the kernel will send expire messages to anyone listening for events on XFRM or PF_KEY sockets. But if a hard limit is reached the kernel also removes the state/policy automatically.

A keying daemon that installs SAs will usually set the limits so that there is enough time between the soft and hard limit to rekey the SA and it will use the expire event for the soft limit as trigger the rekeying. This mechanism is defined in RFC 4301 (Security Architecture for the Internet Protocol).

While a keying daemon could implement its own timer to trigger rekeying after a certain time, this isn't possible for packet/byte limits without relatively expensive polling of the usage counters of each SA.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .