3 ms·
"IPsec" doesn't always protect you against replay attacks for encapsulated UDP packets (unlike TCP which protects itself).
by Bino 13y ago
"IPsec" doesn't always protect you against replay attacks for encapsulated UDP packets (unlike TCP which protects itself).
- kogir 13y agoI thought that was the point of the Authentication Header Sequence Number and the sliding window? If you can tolerate occasional lost packets you can require they only increase and achieve complete protection, no?
- Bino 13y agoYes, you're absolutely right about the existence of Seq. Numbers in IPsec. However, it might not always be enabled, that is if you're using manual keying (and not IKE). http://www.ietf.org/mail-archive/web/ipsec/current/msg05871.html http://www.ietf.org/mail-archive/web/ipsec/current/msg05871....