TCP/IP Tutorial and Technical Overview - IBM Redbooks

348 TCP/IP Tutorial and Technical Overview
receiver to identify the Security Association (SA) to which
an incoming packet is bound.
For a unicast SA, the SPI can be used by itself to specify
an SA, or it can be used in conjunction with the IPSec
protocol type (in this case AH).The SPI field is mandatory.
Traffic to unicast SAs described earlier must be supported
by all AH implementations.
If an IPSec implementation supports multicast, it must
support multicast SAs using a special de-multiplexing
algorithm.
Sequence Number This unsigned 32-bit field contains a counter value that
increases by one for each packet sent, that is, a per-SA
packet sequence number.
For a unicast SA or a single-sender multicast SA, the
sender must increment this field for every transmitted
packet. Sharing an SA among multiple senders is
permitted, though generally not recommended.
The field is mandatory and must always be present even
if the receiver does not elect to enable the anti-replay
service for a specific SA. Processing of the Sequence
Number field is at the discretion of the receiver, but all AH
implementations must be capable of performing the
processing, Thus, the sender must always transmit this
field, but the receiver need not act upon it.
The sender's counter and the receiver's counter are
initialized to 0 when an SA is established. The first packet
sent using a given SA will have a sequence number of 1;
if anti-replay is enabled (the default), the transmitted
sequence number must never be allowed to cycle.
Therefore, the sender's counter and the receiver's counter
must be reset (by establishing a new SA and thus a new
key) prior to the transmission of the 232 packet on an SA.
Extended (64-bit) Sequence Number (ESN)
To support high-speed IPSec implementations, a new
option for sequence numbers should be offered, as an
extension to the current, 32-bit sequence number field.
Use of an Extended Sequence Number (ESN) must be
negotiated by an SA management protocol. The ESN
feature is applicable to multicast as well as unicast SAs.
Integrity Check Value (ICV)