ipsecodp

IPsec anti-replay service, sequence no is less than lower sequence in the window, packet will be dropped?


I have one more query over the IPsec anti replay window service, considering one example. I am having a 64 window size, window size range from 1 to 64. Considering all sequence number received by the receiver except seq no 3, later received seq no 68 and the top window shifted to 4 bits and bottom window to 4 bit right. Top= 68 Bottom= 5 So now in this case, the first question is:

  1. Whether the window will shift 4 bit? I think yes. need input for the same?
  2. If yes what will happen for seq no 3 index which is not received( which was not marked). Later If seq no 3 gets in then seq no < bottom so packet should dropped right? Could someone please share their inputs for the same.

NOTE: I am using a odp-dpdk as the data engine here, linux is not coming into play here.


Solution

  • I didn't quite understand your first question, but yes, the bottom limit becomes 5 now. If you receive a packet with sequence number 3 after that, then the packet will be dropped.

    There's no re-transmission mechanism in IPSec; the upper layer protocols need to take care of the missing packets. For example, TCP will re-transmit a packet which hasn't been acknowledged within a time-frame. At IPSec layer, this packet will get encrypted and transmitted again. IPSec won't even care that it's a re-transmission.