pjhtech Tools
Link & transport

IPsec / ESP Overhead Calculator

Find how many bytes IPsec adds to your packet and the resulting IP packet size.

Input

Original packet and IPsec mode

Enter the whole IP packet before IPsec, including its IP header. Exclude Ethernet framing; do not enter only the application data.

Use the mode configured on the IPsec SA.

The new tunnel header can use a different IP version from the original packet.

ESP settings

Use the data tunnel’s cipher, not its IKE encryption setting.

Use the negotiated tag length: GCM 8, 12 or 16; CBC HMAC 12, 16, 24 or 32.

Choose Yes for UDP-encapsulated ESP, normally on UDP 4500.

Reset restores the example inputs.

Local calculation · inputs are not sent to a server.

Result

Calculation details
Calculating the example…

The report lists each field added to this packet. The 8-byte ESP header is only one part of the total increase.

  • IP header: tunnel mode adds 20 bytes for IPv4 or 40 for IPv6. Transport mode keeps the original header and adds no new IP header.
  • IV: the per-packet encryption value is 8 bytes for GCM or 16 for CBC. GCM’s separate 4-byte salt is not transmitted in each packet.
  • Padding and trailer: the tool adds the smallest padding that fits the cipher, followed by the 2-byte ESP trailer. GCM needs 0–3 padding bytes; CBC needs 0–15.
  • Tag and NAT-T: the selected authentication tag is counted once. NAT-T adds an 8-byte UDP header. ESP data does not contain IKE’s Non-ESP Marker.

For the padding calculation, use the whole original packet in tunnel mode, or its size minus the retained base IP header in transport mode. Add the 2-byte trailer, then round up to a multiple of 4 bytes for GCM or 16 for CBC. The difference is the padding.

Packet after IPsec = original packet + new tunnel header (if any) + ESP header + IV + padding + trailer + tag + UDP header (if NAT-T).

This model uses base IP headers and minimum padding. IP options, IPv6 extension headers, extra TFC padding, AH, GRE and other added encapsulations are not included. The result is an IP packet size, not an Ethernet frame size or an IKE negotiation packet size.

Compare IP packet after IPsec with the IP MTU of the connection carrying it. A 1464-byte packet fits a 1500-byte IP MTU in this model. The tool does not measure the path or predict a device’s fragmentation behavior.

Example: A 1400-byte IP packet becomes 1464 bytes with these settings: 64 bytes are added by IPsec. This example uses an original IPv4 packet, IPv4 tunnel mode, AES-GCM, a 16-byte tag, NAT-T and the smallest required padding.

Use the MTU calculator to work from a known link MTU and a fixed reserve that covers your maximum encapsulation overhead. Use the TCP MSS calculator with the resulting inner IP MTU. Do not use this one packet’s added bytes as a fixed overhead for every packet size.