Kernaali Tools
Home / Network tools / IPsec / ESP Overhead Calculator
Link & transport

IPsec / ESP Overhead Calculator

Calculate ESP expansion for a specific packet, cipher and encapsulation model.

Local calculation · inputs are not sent to a server.

Result

Calculating the example…

How it works

Added bytes comprise a tunnel IP header (if used), an 8-byte ESP header, explicit IV, padding, a 2-byte trailer, authentication tag and optional 8-byte UDP header. GCM uses 4-byte ESP alignment; CBC pads encrypted payload plus trailer to a 16-byte block. Transport mode encrypts the original payload, excluding its base IP header.

Worked example

For a 1400-byte IPv4 packet in IPv4 tunnel mode with AES-GCM, a 16-byte tag and NAT-T, padding is 2 bytes. Expansion is 64 bytes and the outer IP packet is 1464 bytes.

Inputs, edge cases & common mistakes

Base IP headers only: no extension headers, IP options, TFC padding, AH, GRE, L2 encapsulation or fragmentation. The GCM salt is not a per-packet explicit IV. NAT-T ESP data has no four-byte non-ESP marker; that marker is for IKE traffic. CBC tag lengths model selected HMAC truncation, not arbitrary cipher negotiation. Transport mode requires matching IP versions. Actual vendor paths may add more headers.

Technical references

Reviewed 9 September 2026. Found an issue? Send a correction with a reproducible example.