IPSec Overhead Calculator
Break down ESP tunnel overhead byte by byte, find the encapsulated packet size and the largest inner MTU that fits.
Inputs
Total ESP Overhead
72bytes
Encapsulated Packet Size
1,472bytes
Overhead vs Payload
5.14%
Goodput Efficiency
95.11%
Maximum Inner MTU
1,424bytes
Fragmentation Risk
Marginal — within 40 bytes of the path MTU
Step by step
Values used
Inner packet size = 1,400 bytes; Cipher and integrity suite = AES-CBC + HMAC-SHA1-96 — IV 16 B, ICV 12 B; Tunnel mode (adds a new outer IPv4 header) = Yes; NAT traversal (UDP 4500 encapsulation) = Yes; Path MTU = 1,500 bytes
IPSec Overhead
overhead = outer IP (20) + UDP NAT-T (8) + ESP header (8) + IV + pad + pad length/next header (2) + ICV, which lands at 56–73 bytes for tunnel mode.
Total ESP Overhead
= 72 bytes
Encapsulated Packet Size
= 1,472 bytes
Overhead vs Payload
= 5.14
Goodput Efficiency
= 95.11
Maximum Inner MTU
= 1,424 bytes
Fragmentation Risk
= Marginal — within 40 bytes of the path MTU
How it works
ESP in tunnel mode adds a fresh 20-byte outer IPv4 header, an 8-byte ESP header, the cipher's IV, padding to the cipher block size, two trailer bytes and the integrity check value — plus 8 more bytes of UDP if NAT traversal is in play. Because padding aligns the plaintext to a 16-byte boundary, the total varies with payload size but stays inside the familiar 56–73 byte band. Get the overhead wrong and encapsulated packets exceed the path MTU, which either fragments every large flow or blackholes it entirely when ICMP needed-fragmentation messages are filtered.
Formula
IPSec Overhead
overhead = outer IP (20) + UDP NAT-T (8) + ESP header (8) + IV + pad + pad length/next header (2) + ICV, which lands at 56–73 bytes for tunnel mode.
- ESP header
- 4-byte SPI plus 4-byte sequence number
- IV
- Initialisation vector or nonce for the cipher
- ICV
- Integrity check value appended by the authentication algorithm
Frequently Asked Questions
How is IPSec Overhead calculated?
overhead = outer IP (20) + UDP NAT-T (8) + ESP header (8) + IV + pad + pad length/next header (2) + ICV, which lands at 56–73 bytes for tunnel mode. ESP in tunnel mode adds a fresh 20-byte outer IPv4 header, an 8-byte ESP header, the cipher's IV, padding to the cipher block size, two trailer bytes and the integrity check value — plus 8 more bytes of UDP if NAT traversal is in play. Because padding aligns the plaintext to a 16-byte boundary, the total varies with payload size but stays inside the familiar 56–73 byte band.
Why does IPSec Overhead matter?
Get the overhead wrong and encapsulated packets exceed the path MTU, which either fragments every large flow or blackholes it entirely when ICMP needed-fragmentation messages are filtered.
What values do I need to enter?
This calculator takes 5 inputs: Inner packet size, Cipher and integrity suite, Tunnel mode (adds a new outer IPv4 header), NAT traversal (UDP 4500 encapsulation), Path MTU. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is 1400 the classic inner MTU?
It is a round number comfortably below every realistic worst case: 1500 minus about 73 bytes of ESP overhead leaves 1427, and 1400 leaves slack for an extra VLAN tag, GRE header or a 1492-byte PPPoE path. Clamping TCP MSS to 1360 alongside it is what stops fragmentation in practice.