Calculator Inputs
Example Data Table
| Scenario | Profile | Mode | Original Packet | Overhead | Encapsulated Size | Useful Throughput |
|---|---|---|---|---|---|---|
| Datacenter tunnel | ESP AES-GCM (16-byte ICV) | Tunnel | 1,400 B | 56 B | 1,456 B | 865.38 Mbps |
| Branch over NAT | ESP AES-CBC + HMAC-SHA1-96 | Tunnel | 1,200 B | 80 B | 1,280 B | 159.38 Mbps |
| Authenticated transport | AH HMAC-SHA256-128 | Transport | 512 B | 28 B | 540 B | 90.07 Mbps |
Formula Used
1. Added overhead = outer IP header + UDP encapsulation + security headers + IV or nonce + padding + trailer + ICV or AH bytes.
2. Encapsulated packet size = original IP packet size + added overhead.
3. Efficiency = original packet size ÷ encapsulated packet size.
4. Effective wire throughput = minimum of planned line rate, crypto ceiling, and packet-rate ceiling.
5. Useful throughput = effective wire throughput × efficiency.
6. No-fragment original packet = MTU − added overhead.
7. Recommended TCP MSS = no-fragment original packet − IP header − 20-byte TCP header.
How to Use This Calculator
- Enter the raw link bandwidth and the utilization target you want to reserve for protected traffic.
- Set the average original IP packet size and the MTU that the protected path must honor.
- Choose tunnel or transport mode, then select inner and outer IP versions.
- Pick the security profile that matches your deployment, or switch to a custom profile.
- Enable NAT-T only when ESP must cross NAT devices.
- Add traffic flow padding or hardware ceilings when you need conservative capacity planning.
- Press Calculate Throughput to view useful throughput, overhead, no-fragment size, and MSS guidance.
- Use the CSV or PDF buttons to export the current result for design notes or change reviews.
FAQs
1. Why does tunnel mode reduce throughput more?
Tunnel mode adds a new outer IP header and protects the whole original packet. That extra encapsulation increases bytes on the wire, lowers efficiency, and reduces no-fragment payload budget.
2. When should NAT-T be enabled?
Enable NAT-T when ESP traffic must pass through one or more NAT devices. It adds a UDP header, which increases overhead, but it helps protected sessions survive address translation.
3. Why is packet size important for throughput estimates?
Overhead is applied per packet, not per megabit. Smaller packets carry the same headers more often, so their efficiency drops faster and their useful throughput declines sooner.
4. Does this calculator replace vendor performance testing?
No. It estimates protocol efficiency and applies optional rate ceilings. Real appliances may bottleneck because of CPU limits, offload behavior, packet mix, rekey activity, or inspection services.
5. What does the crypto engine ceiling represent?
It is an optional wire-rate cap for the device or service performing protection. Use it when published throughput or lab-tested performance is lower than the physical link speed.
6. Why can padding change even when payload stays similar?
Padding depends on the selected profile, the block-size requirement, and the need to align the integrity field. A small payload change can alter the next valid alignment point.
7. How should I use the recommended TCP MSS?
Use it as a conservative starting point for MSS clamping or design checks. It helps keep protected packets inside the MTU after encapsulation, reducing fragmentation risk.
8. Can AH use NAT-T in real deployments?
No. AH authenticates IP header fields that NAT usually changes, so NAT traversal is not a normal fit. This page automatically ignores NAT-T when an AH profile is selected.