登录查看更多内容

Last updated on 2024年8月9日

全部
IPSec

How does ESP handle fragmentation and reassembly of packets?

由人工智能和领英社区提供技术支持

IPSec is a protocol suite that provides security and privacy for network communications. One of its components is ESP, or Encapsulating Security Payload, which encrypts and authenticates the data in each packet. But what happens when a packet is too large to fit in the maximum transmission unit (MTU) of the network? How does ESP handle fragmentation and reassembly of packets? In this article, you will learn about the challenges and solutions of ESP fragmentation and reassembly.

此文章中的业界达人

由社区从 6 条内容中精选。了解更多

Ajay Upadhyay

Information Security Expert / Cyber Security Enthusiast…

1 Fragmentation before ESP

One option is to fragment the packet before applying ESP. This means that the original packet is divided into smaller pieces, each with its own IP header, and then ESP is applied to each fragment. The advantage of this approach is that it avoids the overhead of ESP padding, which adds extra bytes to align the packet to a multiple of the encryption block size. The disadvantage is that it exposes the IP header of each fragment to potential attacks, such as replay, modification, or spoofing.

添加您的观点

Ajay Upadhyay

Information Security Expert / Cyber Security Enthusiast CISSP, CISM, CRISC, CCSP, CEH, CISA
举报内容
The ESP is a critical component of the IPSec suite, designed to protect data confidentiality, integrity, and source authenticity. Dealing with the challenge of packet fragmentation is an important goal with respect to this regard; this happens whenever a data packet is larger than the MTU of any network. ESP encapsulates data in a security structure, with a header and trailer, so as not to compromise the integrity of an original packet. The ESP header contains information necessary for reassembling the original packets, all of which is available in every fragmented packet. At the destination, ESP reconstructs fragmented packets to a very high degree of accuracy using sequence numbers and other identifiers to ensure data integrity.

已翻译

赞
Amarulla Khan

Cloud Operations and Network Engineer @ CubeLogic
举报内容
In IP networks, fragmentation occurs when a data packet is larger than the MTU of the network it's traversing. The packet is divided into smaller fragments, each with its own header information to allow for reassembly at the destination. The ESP in IPsec does not handle the fragmentation and reassembly of packets; instead, it expects packets to be fragmented before they reach the ESP processing. If a packet requires fragmentation after ESP has been applied, the resulting fragments would not be protected individually by ESP. Therefore, it's crucial to ensure that packets are of an appropriate size before ESP processing to maintain security. Reassembly of fragmented packets is typically handled by the receiving end of the communication.

已翻译

赞

2 Fragmentation after ESP

Another option is to fragment the packet after applying ESP. This means that the original packet is encrypted and authenticated by ESP, and then divided into smaller pieces, each with a new IP header and an ESP trailer. The advantage of this approach is that it protects the IP header of the original packet from attacks, as well as the payload. The disadvantage is that it requires more processing and bandwidth, as each fragment needs to be padded, encrypted, authenticated, and encapsulated.

添加您的观点

Amarulla Khan

Cloud Operations and Network Engineer @ CubeLogic
举报内容
The Encapsulating Security Payload (ESP) is a protocol providing security services for IP packets such as confidentiality, data origin authentication, and more. ESP does not inherently handle the fragmentation and reassembly of packets; this is managed by the IP layer. When an IP packet, which may be secured by ESP, exceeds the Maximum Transmission Unit (MTU) of the network, it needs to be fragmented. This fragmentation occurs before ESP processing. Reassembly of these fragments is done at the destination before the ESP processing is reversed. If a packet is fragmented after ESP has been applied, the reassembly must occur before decryption, as each fragment is treated as a separate ESP packet.

已翻译

赞

3 Reassembly at destination

Regardless of the fragmentation option, the reassembly of the packets is done at the destination host, not at intermediate routers or gateways. This is because the ESP header and trailer are opaque to the network layer, and only the destination host has the keys and algorithms to decrypt and verify the packets. The destination host uses the identification field in the IP header and the sequence number field in the ESP header to reassemble the fragments into the original packet.

添加您的观点

Amarulla Khan

Cloud Operations and Network Engineer @ CubeLogic
举报内容
ESP is a member of the IPsec protocol suite that provides data privacy by encrypting the payload of IP packets. ESP does not inherently handle the fragmentation and reassembly of packets; this is managed by the underlying IP layer. When ESP-protected packets need to traverse a network with a smaller Maximum Transmission Unit (MTU) than the packet size, the IP layer may fragment these packets. The receiving end's IP layer is responsible for reassembling the fragments back into the original packet before ESP processing. For more details on the mechanics of IP fragmentation and reassembly, RFC 791 can be consulted. Additionally, issues related to fragmentation and Path MTU Discovery (PMTUD) can be reviewed in Cisco's documentation.

已翻译

赞

4 Reassembly issues

Reassembling ESP packets can be difficult and cause several issues, such as fragment loss, duplication, overlap, or reordering. Fragment loss can lead to data loss or reduced performance. Duplication, overlap, and reordering can all cause data corruption or security breaches. All of these can result in the ESP processing failing.

添加您的观点

Amarulla Khan

Cloud Operations and Network Engineer @ CubeLogic
举报内容
The Encapsulating Security Payload (ESP) protocol is part of the IPsec suite used to provide secure communication over IP networks. ESP does not inherently handle the fragmentation and reassembly of packets; this is managed by the underlying IP protocol. When a packet size exceeds the Maximum Transmission Unit (MTU) of the network, IP fragmentation occurs, splitting the packet into smaller fragments that can be transmitted. Reassembly of these fragments is then performed by the receiving end of the communication. ESP operates transparently to this process, providing encryption and authentication for the IP packets, whether they are fragmented or not. For detailed standards and processes, RFC 4303 provides comprehensive information.

已翻译

赞

5 Reassembly solutions

To combat reassembly issues, some solutions are fragmentation avoidance, which involves adjusting the MTU of the network or using PMTUD to determine the optimal packet size for each route. If fragmentation is unavoidable, then fragmentation coordination should be used between the sender and the receiver, either manually or with negotiation protocols such as IKE or IPComp. Lastly, reassembly timeout can be used to discard incomplete or invalid packets and request retransmission if needed.

添加您的观点

Amarulla Khan

Cloud Operations and Network Engineer @ CubeLogic
举报内容
In the context of ESP (Encapsulating Security Payload), fragmentation and reassembly are not handled by ESP itself but by the underlying IP layer. ESP is designed to provide confidentiality, integrity, and authentication for IP packets. When it comes to fragmentation, if an IP packet is too large for the network path's MTU (Maximum Transmission Unit), the IP layer handles breaking down this packet into smaller fragments that can be transmitted independently. These fragments are then reassembled by the IP layer at the destination. ESP will encrypt the payload of an IP packet, but it does not alter the fragmentation process that is managed by the IP layer.

已翻译

赞

6 Reassembly trade-offs

The choice of fragmentation and reassembly option depends on the trade-offs between performance and security. Fragmentation before ESP offers better performance but lower security, while fragmentation after ESP offers better security but lower performance. Reassembly at destination offers better security but higher complexity, while reassembly at intermediate nodes offers lower complexity but higher vulnerability. Reassembly solutions offer better reliability but higher overhead. Therefore, you should consider your network environment, security requirements, and performance goals when deciding how to handle ESP fragmentation and reassembly.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

IPSec

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How does ESP handle fragmentation and reassembly of packets?

1

2

3

4

5

6

7

1 Fragmentation before ESP

2 Fragmentation after ESP

3 Reassembly at destination

4 Reassembly issues

5 Reassembly solutions

6 Reassembly trade-offs

7 Here’s what else to consider

IPSec

给文章评分

感谢您的反馈

更多IPSec相关文章

更多相关阅读内容