Why Block an Old Encrypted Packet? IPsec Anti-Replay Windows Explained

A remote data link is encrypted, so why does a security gateway still record packet sequence numbers? Keeping outsiders from reading a message and preventing the same message from being accepted again are different goals. Someone can copy a legitimate packet and send it again without understanding its contents. Anti-replay gives the receiver a record of packets it has already accepted.

An unchanged packet can still be a duplicate

Imagine a sealed work order. The seal can help show that the contents have not been altered, but it does not by itself show that the same order has not already been delivered. A captured encrypted packet can similarly be sent again, without the attacker decrypting it or creating a new valid command.

This analogy explains repeated delivery only. Actual protocols use keys and authentication algorithms. Confidentiality, integrity and anti-replay address different needs. Ethernet error detection does not replace cryptographic authentication: detecting transmission errors is different from checking whether a packet was created by a holder of the appropriate key.

A product description that mentions encryption does not by itself establish how old packets are rejected. Identify the protocol, its actual security endpoints, negotiated settings and receiver checks. This article uses IPsec ESP as an example; it does not assign anti-replay capability to every industrial device along the path.

Find the two endpoints that keep the record

IPsec can protect traffic over an IP network, and ESP is one of its packet protection mechanisms. A security association, or SA, is a set of protection arrangements for one direction, including the relevant keys, algorithms and state. Records for the two directions should not be treated as one shared counter.

The sender numbers packets belonging to an SA. The receiver selects the relevant association and checks its own record; it does not compare a number against every device on the network. The ESP Security Parameters Index (SPI) helps identify the association, while its sequence number supports anti-replay checks. These fields must receive the relevant integrity protection.

A serial server, industrial Ethernet switch and external security gateway may all be present in the same link. Feichang’s FCT-1100-F1S1 serial device server provides a real serial-to-network product context; this does not claim that it implements IPsec. If external gateways terminate the tunnel, they perform the endpoint checks. An ordinary forwarding switch does not automatically acquire an anti-replay window.

Why not accept only numbers above the last one?

Packets do not always arrive in the order sent. Paths, queues and parallel processing can make a later packet arrive first. A receiver that rejects every number below its highest number could discard legitimate delayed traffic. The check needs to recognize duplicates while tolerating some reordering.

Think of a sliding window as numbered slots. Each slot records whether a packet with that sequence number has already been authenticated and accepted; it does not store the whole packet. The upper end tracks the highest authenticated number and the lower end bounds how far an unseen packet may arrive out of order. A packet that is too old is dropped.

For a teaching example, suppose the window contains numbers 101 through 108 and 106 has already been accepted. A second 106 is a duplicate. If 105 has not been seen, it may proceed to authentication. Eight slots are only an illustration, not a standard window size or a specification for a Feichang product.

Move the window only after authentication succeeds

When packet 109 arrives, the receiver must not advance its record simply because the number is larger. Otherwise an attacker could forge a very large number and push legitimate traffic outside the window. The order of checks matters more than memorizing the phrase “slide the window.”

An implementation may first perform a preliminary sequence check and discard an obvious duplicate or an old packet. An eligible packet must still pass the appropriate integrity or authentication check. Only after success is it recorded as received and the window advanced if needed. A preliminary check does not make the packet trustworthy.

A packet that fails authentication must not occupy a new slot or advance the highest authenticated number. Different algorithms and implementations can organize internal work differently. The essential distinction is between an initial filter, cryptographic validation and committing the state. A larger number alone is not permission to deliver.

Loss, reordering and replay can look similar

The window can accept an unseen number that arrives within its range, but it cannot accept arbitrarily late traffic. Severe reordering may put a legitimate packet below the lower edge. A rising discard count therefore does not by itself prove an attack, a damaged fiber or a failed switch port.

Correlate the time, direction, security association and application records. Check whether a route change, queue buildup or gateway load changed at the same time. Increasing a window is not a universal fix: verify implementation limits, processing costs and acceptable lateness. Do not disable protection merely to hide an alarm.

The window does not recover a lost packet. It determines whether a packet can proceed; retransmission, session recovery and application timeout behavior belong to the appropriate transport or application mechanism. An anti-replay window is not a reliable delivery protocol or a general packet-reordering buffer.

A new tunnel packet may contain an old application command

An application can send the same operation again. The security endpoint can encapsulate that second request in a new outer packet with a new sequence number. At the tunnel layer it is not the previously accepted ESP packet; at the application layer it may still be a duplicate operation.

Anti-replay therefore does not guarantee that every command executes only once. Depending on the real protocol, important operations may need transaction identifiers, duplicate-request handling, expiry, permissions and checks against the current state. Such features require agreement and verification at both endpoints; adding a field alone does not establish complete security.

A valid unseen packet inside the window also is not necessarily timely for the business operation. Whether a delayed command should be executed is an application decision. Separate packet duplication, sender authenticity and whether the action is appropriate now.

Turn the mechanism into a verifiable project record

Mark the tunnel endpoints and the scope they actually protect. Verify the protocol, negotiation, supported window and the meaning of logs. Serial interfaces, Ethernet forwarding and security processing are different layers. Fiber, VLAN or serial networking support does not establish support for any particular cryptographic algorithm or certification.

In an authorized test environment, use isolated harmless data to observe normal order, permitted reordering, repeated packets and failed authentication. Record the documentation version, configuration and results. Do not replay real production control commands or present the diagram’s illustrative numbers as measurements.

Remember three responsibilities: encryption protects content, a replay window records accepted packet numbers, and the application still handles duplicate operations and timing. Authentication prevents an invented sequence number from simply advancing the trusted record. Together these boundaries make an industrial communication design easier to evaluate.

Translated from the Chinese technical article: Read the original Chinese article.