Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute“IPsec at LinuxCon” refers to Sowmini Varadhan’s 2016 LinuxCon North America presentation, “Securing Network Traffic Tunneled Over Kernel managed TCP/UDP sockets.” It examines how to secure traffic carried by kernel-managed sockets in cloud and cluster networking, and weighs IPsec against TLS or DTLS at the socket layer. Its performance figures describe a specific 10G-era test setup, not what a current system should be expected to achieve.
What the LinuxCon talk was about
Varadhan presented the talk at LinuxCon North America 2016 in Toronto. Its focus was protecting traffic carried by kernel-managed TCP and UDP sockets, with examples including VXLAN, GUE, Geneve, RDS-TCP, and KCM. The underlying concern was that traffic in these use cases could be exposed in the clear, including tenant payloads, tunnel headers, and, for RDS-TCP and KCM, TCP/IP control traffic.
The presentation framed the problem around three practical goals: confidentiality and integrity for network traffic, reasonable performance, and behavior compatible with failover in clustered or high-availability environments. It is a historical systems presentation, not a current kernel configuration guide. The Linux Foundation’s LinuxCon overview describes an event audience of Linux maintainers, developers, and project leads, with networking and performance among its subject areas.
Why compare TLS or DTLS with IPsec?
The talk compares protection at two different layers. TLS or DTLS operates at the socket layer; IPsec protects traffic at the IP layer. The speaker’s case for IPsec is specific to kernel-managed sockets and the control-plane and failover requirements discussed, not a claim that IPsec is always preferable to TLS.
| Consideration | TLS or DTLS at the socket layer | IPsec at the IP layer |
|---|---|---|
| Where protection sits | At the socket layer, closer to the application or socket using the connection. | At the IP layer, below the kernel-managed TCP or UDP socket. |
| Potential fit noted in the talk | The slides cite per-user authentication and the possibility of deploying outside the kernel. | The slides describe IPsec as integrated with Linux and suited to protecting traffic independently of a particular socket type. |
| Design complexity raised | Kernel socket types complicate TLS deployment. Separating TLS negotiation and control from kernel encryption can require coordination for synchronization and rekeying; the talk also raises TCP attack exposure. | The presentation describes established interfaces between user-space key management and the kernel. IKE establishes keys and security associations (SAs), which are installed in the kernel. |
| Failover concerns | Control-plane coordination and rekeying need to work with the kernel data path and cluster behavior. | The talk considers IPsec in the context of cluster and high-availability requirements; it does not establish that IPsec automatically solves failover. |
Discussing the complexity of splitting TLS control and data planes, the deck quotes a statement attributed to Netflix/OCA: “..when you consider .. that messages in the TCP stream may arrive out of order, adding TLS for both sending and receiving adds a lot of complexity to the kernel”. That is a quotation reproduced by the presentation, not an independently verified primary statement from Netflix.
How the slides describe IPsec and its modes
The presentation describes ESP as providing confidentiality, data-origin authentication, integrity, and anti-replay protection. A Security Parameter Index (SPI) identifies the security association, while a sequence number supports replay protection.
| Mode | What the slides say is transformed | Routing information | Use mentioned in the talk |
|---|---|---|---|
| Transport | The Layer 4 header and payload. | Original Layer 3 routing information is not modified. | Host-to-host; the speaker says this is sufficient for the cloud or cluster case discussed. |
| Tunnel | The original IP packet is encapsulated in another IP packet. | Routing information may be modified. | VPNs. |
This is the presentation’s simplified comparison; it is not a complete protocol-selection guide.
What the performance numbers mean
Varadhan reports an iPerf single-stream throughput and CPU-utilization evaluation on a 10G line using an X5-4 system and Intel ixgbe. The tests varied segmentation and receive coalescing settings (TSO, GSO, and GRO), clear traffic versus IPsec, null encryption versus AES-GCM-256 or AES-CCM-128, and checksum offload settings. The slides say IPsec transforms must follow segmentation and that, in the setup described, TSO, GSO, and GRO were disabled when IPsec was engaged.
Rank #3
| Configuration reported | Throughput | Peak CPU utilization |
|---|---|---|
| ESP-NULL, baseline processing — Varadhan’s LinuxCon North America 2016 presentation; described 10G test system and configuration. | 2.6 Gbps | 71% |
| ESP-NULL, with GSO/GRO offload — same presentation and test context. | 8 Gbps | 95% |
| AES-GCM-256, baseline processing — same presentation and test context. | 2.17 Gbps | 83% |
| AES-GCM-256, with GSO/GRO offload — same presentation and test context. | 4.2 Gbps | 100% |
These are measurements reported for the presentation’s particular system and configuration, not current kernel benchmarks or hardware-independent expectations. The slides also report a substantial performance penalty from disabling segmentation and receive offload even for clear traffic. In the IPsec cases, the team needed manual receive-side iPerf placement and IRQ balancing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Performance ideas raised—and what they do not prove today
The presentation identified several avenues for improving performance. It treated them as ongoing or future work in 2016, so the talk alone does not establish whether a particular proposal is supported by a current kernel or NIC.
Rank #4
- Preserve segmentation and coalescing benefits: investigate applying IPsec transforms around GSO/GRO processing so software can retain the benefits of segmentation and receive coalescing.
- Make better use of NIC capabilities: improve hardware IPsec offload support and how the Linux networking stack uses available NIC features.
- Improve receive-side flow steering: ordinary RSS/RFS classification cannot use encrypted TCP/UDP port numbers in the usual way. The slides ask whether the ESP SPI could be used as a flow-hash input and answer yes.
Linux IPsec development remains active: the Linux Foundation kernel mirror of Steffen Klassert’s IPsec networking tree displays a tag dated 2026-09-07. That is evidence of ongoing subsystem development, not confirmation that any specific 2016 performance proposal was merged or is available in a given kernel. Check version-specific kernel documentation or source before relying on a feature operationally.
Quick Recap
Best Value
What to take away from the presentation
- It is a 2016 talk about a defined problem: securing traffic carried by kernel-managed TCP and UDP sockets in cloud and cluster settings.
- Its TLS/DTLS versus IPsec comparison concerns layer placement, kernel socket constraints, key-management and control-plane coordination, and failover requirements; it is not a universal ranking of the technologies.
- The reported throughput figures are tied to one presentation’s test system and configuration. Their most useful lesson is that offload behavior and CPU cost can materially affect results.
- GSO/GRO, NIC offload, and receive flow steering were central performance themes, but the slides’ future-work labels should not be mistaken for current feature-status documentation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
