Heuristics for Detecting ESP-NULL Packets

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 32
Abstract: This document describes a set of heuristics for distinguishing IPsec ESP-NULL (Encapsulating Security Payload without encryption) packets from encrypted ESP packets. These heuristics can be used on intermediate devices, like traffic analyzers, and deep-inspection engines, to quickly decide whether or not a given packet flow is encrypted, i.e., whether or not it can be inspected. Use of these heuristics does not require any changes made on existing IPsec hosts that are compliant with RFC 4303. This document is not an Internet Standards Track specification; it is published for informational purposes.
Publication Date: 2010-05-01
Status Note: Informational
DOI: 10.17487/RFC5879
Link: https://doi.org/10.17487/RFC5879
Author(s): Tero Kivinen
Daniel L. McDonald
Keyword(s): IPSEC, WESP, Packet Inspection

Latest version of IETF RFC 5879

Document Versions — IETF RFC 5879

▶ IETF RFC 5879 (2010-05-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2410 [Active*]
IETF RFC 4301 [Active, Amended*]
IETF RFC 4302 [Active*]
IETF RFC 4303 [Active*]

Bibliographic Reference(s)

Hoffman, P. and D. McGrew, "An Authentication-only Profile for ESP with an IP Protocol Identifier", Work in Progress, August 2007. EXTERNAL
Bhatia, M., "Identifying ESP-NULL Packets" , Work in Progress, December 2008. EXTERNAL
IETF RFC 3948 [Active*]
IETF RFC 4359 [Active*]
IETF RFC 4555 [Active*]
IETF RFC 4835 [Superseded*]
IETF RFC 4960 [Superseded*]
IETF RFC 5840 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC5879.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 5879, Heuristics for Detecting ESP-NULL Packets. Available at https://doi.org/10.17487/RFC5879

Snippet:

IETF RFC 5879, Heuristics for Detecting ESP-NULL Packets. Available at https://doi.org/10.17487/RFC5879

HTML (ISO 690 compliant)

Preview:

IETF RFC 5879, Heuristics for Detecting ESP-NULL Packets. Available at https://doi.org/10.17487/RFC5879

Snippet:

<span class="citation"><cite>IETF RFC 5879</cite>, Heuristics for Detecting ESP-NULL Packets. Available at <a href="https://doi.org/10.17487/RFC5879" target="_blank" rel="noopener">https://doi.org/10.17487/RFC5879</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 5879, Heuristics for Detecting ESP-NULL Packets
doi: 10.17487/RFC5879
url: https://doi.org/10.17487/RFC5879

Snippet:

<li>
<cite id="bib-rfc5879">IETF RFC 5879</cite>, Heuristics for Detecting ESP-NULL Packets
<span class="doi">10.17487/RFC5879</span>
</li>

Referenced By

IETF RFC 6071 [Active*]
IETF RFC 7166 [Active*]