Calculate IPsec tunnel overhead and effective throughput for encrypted traffic.
IPsec overhead depends on both the protocol and mode chosen. ESP (Encapsulating Security Payload) adds a header, trailer, and authentication data (roughly 22 bytes fixed) plus variable padding to align the payload to the encryption cipher's block size. AH (Authentication Header) provides integrity/authentication without encryption, adding a fixed ~24 bytes with no padding needed since there's no block cipher. Tunnel mode wraps the entire original IP packet with a new outer IP header (adding 20 bytes for IPv4), enabling site-to-site VPNs where the original source/destination stay hidden — while transport mode protects only the payload and reuses the original IP header, adding less overhead but only working end-to-end between the two IPsec peers themselves.
Total overhead
overhead = protocol_fixed + cipher_padding (ESP only) + 20 (tunnel mode outer IP)
ESP encrypts the payload using a block cipher (like AES), which requires the plaintext to be padded to a multiple of the cipher's block size (16 bytes for AES) before encryption — AH only provides authentication/integrity checking without any encryption, so there's no block cipher alignment requirement and no padding needed.
Tunnel mode is used for site-to-site or remote-access VPNs where traffic between two networks needs to be protected end-to-end across an untrusted path, since it encapsulates the entire original packet and hides the original addresses. Transport mode is used when the two communicating hosts are themselves the IPsec endpoints (e.g. host-to-host protection on a trusted LAN), since it has less overhead but doesn't work for routing traffic between different subnets through an intermediate gateway.
AH authenticates the entire packet including parts of the outer IP header, which breaks when traffic passes through NAT (since NAT rewrites IP addresses) — ESP with its NAT-Traversal (NAT-T) extension handles this correctly, and ESP also provides both encryption and authentication in one protocol, making it the near-universal choice for modern IPsec VPNs.