IPSec Overhead Calculator
Break down ESP tunnel overhead byte by byte, find the encapsulated packet size and the largest inner MTU that fits.
About IPSec Overhead Calculator
ESP in tunnel mode adds a fresh 20-byte outer IPv4 header, an 8-byte ESP header, the cipher's IV, padding to the cipher block size, two trailer bytes and the integrity check value — plus 8 more bytes of UDP if NAT traversal is in play. Because padding aligns the plaintext to a 16-byte boundary, the total varies with payload size but stays inside the familiar 56–73 byte band. Get the overhead wrong and encapsulated packets exceed the path MTU, which either fragments every large flow or blackholes it entirely when ICMP needed-fragmentation messages are filtered.
Formula
IPSec Overhead
overhead = outer IP (20) + UDP NAT-T (8) + ESP header (8) + IV + pad + pad length/next header (2) + ICV, which lands at 56–73 bytes for tunnel mode.
- ESP header
- 4-byte SPI plus 4-byte sequence number
- IV
- Initialisation vector or nonce for the cipher
- ICV
- Integrity check value appended by the authentication algorithm
Worked example
With the default values below, IPSec Overhead Calculator returns Total ESP Overhead of 72. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Inner packet sizeaccepts 20–9,000 bytes
- 1,400 bytes
- Cipher and integrity suiteone of AES-CBC + HMAC-SHA1-96 — IV 16 B, ICV 12 B, AES-CBC + HMAC-SHA256-128 — IV 16 B, ICV 16 B, AES-GCM-128/256 — nonce 8 B, ICV 16 B, AES-CTR + HMAC-SHA1-96 — IV 8 B, ICV 12 B
- AES-CBC + HMAC-SHA1-96 — IV 16 B, ICV 12 B
- Tunnel mode (adds a new outer IPv4 header)
- Yes
- NAT traversal (UDP 4500 encapsulation)
- Yes
- Path MTUaccepts 576–9,216 bytes
- 1,500 bytes
Results
- Total ESP Overhead
- 72 bytes
- Encapsulated Packet Size
- 1,472 bytes
- Overhead vs Payload
- 5.14%
- Goodput Efficiency
- 95.11%
- Maximum Inner MTU
- 1,424 bytes
- Fragmentation Risk
- Marginal — within 40 bytes of the path MTU
Step by step
- 1Values used
- 2IPSec Overhead
- 3Total ESP Overhead= 72 bytes
- 4Encapsulated Packet Size= 1,472 bytes
- 5Overhead vs Payload= 5.14
- 6Goodput Efficiency= 95.11
- 7Maximum Inner MTU= 1,424 bytes
- 8Fragmentation Risk= Marginal — within 40 bytes of the path MTU
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is IPSec Overhead calculated?
overhead = outer IP (20) + UDP NAT-T (8) + ESP header (8) + IV + pad + pad length/next header (2) + ICV, which lands at 56–73 bytes for tunnel mode. ESP in tunnel mode adds a fresh 20-byte outer IPv4 header, an 8-byte ESP header, the cipher's IV, padding to the cipher block size, two trailer bytes and the integrity check value — plus 8 more bytes of UDP if NAT traversal is in play. Because padding aligns the plaintext to a 16-byte boundary, the total varies with payload size but stays inside the familiar 56–73 byte band.
Why does IPSec Overhead matter?
Get the overhead wrong and encapsulated packets exceed the path MTU, which either fragments every large flow or blackholes it entirely when ICMP needed-fragmentation messages are filtered.
What values do I need to enter?
This calculator takes 5 inputs: Inner packet size, Cipher and integrity suite, Tunnel mode (adds a new outer IPv4 header), NAT traversal (UDP 4500 encapsulation), Path MTU. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is 1400 the classic inner MTU?
It is a round number comfortably below every realistic worst case: 1500 minus about 73 bytes of ESP overhead leaves 1427, and 1400 leaves slack for an extra VLAN tag, GRE header or a 1492-byte PPPoE path. Clamping TCP MSS to 1360 alongside it is what stops fragmentation in practice.