Question 1

How much overhead does IPSec ESP tunnel mode add?

Accepted Answer

IPSec ESP tunnel mode adds: new IP header 20 bytes, ESP header 8 bytes, IV 16 bytes for AES-CBC or 8 bytes for AES-GCM, AES-CBC padding 0 to 15 bytes, ESP trailer 2 bytes, and ICV 12 bytes for HMAC-SHA1-96 or 16 bytes for HMAC-SHA2-256-128. Total typical overhead: 58 to 74 bytes for AES-256-CBC with SHA2-256, or 50 to 58 bytes for AES-128-GCM.

Question 2

How much overhead does GRE tunnel add?

Accepted Answer

GRE adds a new IP header 20 bytes plus a GRE header 4 bytes minimum. Total minimum GRE overhead is 24 bytes, giving effective MTU of 1476 on a 1500-byte interface. Optional GRE fields such as checksum, key, and sequence number add 4 bytes each. GRE without IPSec provides encapsulation but no encryption.

Question 3

What is the overhead for GRE over IPSec?

Accepted Answer

GRE over IPSec stacks both overheads. GRE adds 24 bytes, then IPSec ESP in transport mode adds approximately 46 to 62 bytes. Total overhead: 70 to 86 bytes, giving effective MTU of approximately 1414 to 1430 bytes on a 1500-byte interface. Add 8 more bytes if NAT-T UDP 4500 is used.

Question 4

What is the effective MTU for an IPSec VPN tunnel?

Accepted Answer

Effective MTU equals physical interface MTU minus tunnel overhead. For a 1500-byte Ethernet interface: GRE only gives 1476, IPSec ESP tunnel mode with AES-256-CBC and SHA2-256 gives approximately 1426 to 1442, and GRE over IPSec gives approximately 1414 to 1430. Configure the tunnel interface MTU to match this value to prevent fragmentation.

Question 5

Why does IPSec use AES padding and how does it affect overhead?

Accepted Answer

AES-CBC requires plaintext to be a multiple of 16 bytes. The ESP trailer 2 bytes plus the payload must be padded to the next 16-byte boundary. Padding ranges from 0 to 15 bytes depending on packet size. AES-GCM eliminates this padding requirement entirely, saving 0 to 15 bytes per packet and simplifying MTU calculations.

Question 6

What is the difference between IPSec tunnel mode and transport mode?

Accepted Answer

IPSec tunnel mode encapsulates the entire original IP packet with a new IP header, adding 20 extra bytes of overhead. It is used for site-to-site VPNs. IPSec transport mode only adds the ESP or AH header without a new IP header, saving 20 bytes. Transport mode is used in GRE over IPSec where the GRE header already provides the outer IP encapsulation.

Question 7

Does IPSec encryption affect throughput?

Accepted Answer

IPSec affects throughput in two ways. First, header overhead reduces effective throughput proportionally: 70 bytes overhead on 1500-byte packets reduces throughput by approximately 4.5 percent. Second, encryption processing adds latency and may limit throughput on software-only implementations. Hardware AES-NI acceleration on modern CPUs and enterprise routers eliminates most processing overhead.

Question 8

What is IPSec AH versus ESP?

Accepted Answer

AH Authentication Header provides authentication and integrity only with no encryption. AH overhead is 24 bytes. AH is rarely used today because it cannot traverse NAT and provides no confidentiality. ESP Encapsulating Security Payload provides encryption, authentication, and integrity and is the standard for all modern VPN deployments. ESP with NULL encryption provides authentication-only protection that is NAT-compatible.

Question 9

How does IPSec affect small packet VoIP performance?

Accepted Answer

Small packets suffer proportionally higher overhead. A 64-byte VoIP packet with 74 bytes of IPSec ESP overhead results in 138 bytes total, representing 115 percent overhead. A 1500-byte data packet with the same overhead adds only 4.9 percent. Configure QoS to prioritize voice traffic and consider header compression such as cRTP for VoIP over IPSec VPN tunnels to reduce per-packet bandwidth consumption.

Question 10

What is NAT-T and how does it add overhead?

Accepted Answer

NAT Traversal NAT-T encapsulates IPSec ESP packets in UDP port 4500 when NAT is detected between VPN peers. This adds a UDP header 8 bytes plus a non-ESP marker 4 bytes for a net overhead of 8 bytes per packet. NAT-T is automatically negotiated by IKEv2 when NAT is detected. This is common for remote access VPN clients behind home NAT routers and adds slightly more overhead than direct IPSec connections.

Question 11

Why is AES-GCM better than AES-CBC for IPSec?

Accepted Answer

AES-GCM has three advantages over AES-CBC for IPSec: it provides both encryption and authentication in one operation eliminating the need for a separate HMAC, it has no block-alignment padding requirement saving 0 to 15 bytes per packet, and it uses an 8-byte IV instead of 16 bytes saving another 8 bytes. Total savings of 8 to 23 bytes per packet compared to AES-256-CBC with HMAC-SHA2-256. AES-GCM also performs better on modern hardware.

Tunnel Type	Typical Overhead	Effective MTU	Notes
GRE only	24 bytes	1476 bytes	No encryption, trusted links only
IPSec ESP AES-128-GCM	50–58 bytes	1442–1450 bytes	Modern preferred, no padding
IPSec ESP AES-256-CBC + SHA2	62–74 bytes	1426–1438 bytes	Most common site-to-site
GRE over IPSec AES-256-CBC	76–88 bytes	1412–1424 bytes	Standard DMVPN/FlexVPN
GRE over IPSec + NAT-T	84–96 bytes	1404–1416 bytes	Remote sites behind NAT

IPSec & GRE Overhead Calculator 2026

Sources & Methodology

How Is IPSec and GRE Overhead Calculated?

Tunnel Type Overhead Comparison

AES-GCM vs AES-CBC for IPSec

MTU Configuration for IPSec Tunnels

Missing a Networking Calculator?