RE: IPSEC over UDP or TCP

The real point in this is that using TCP to encapsulate IP traffic which
itself consist of TCP traffic is a very bad idea, UDP is the go. Why ?
In case of congestion, there is a clash between the 2 tcp session
timers: the outer one (the carrying one) will retransmit the
lost/non-acked segments. This mean that for the inner TCP session (the
user traffic), it wont receive any packet for a while, make it drop very
much it's sending rate. For more details, have a look to 
http://sites.inka.de/sites/bigred/devel/tcp-tcp.html

As of overhead is concerned, i really dont think this is a real
argument, i still wait on seeing numbers.

On Wed, 2003-10-08 at 00:17, Bill Yazji wrote:
> Quantify your "con" - significant testing has shown this really isn't the
> case....
> 
> ~B
> 
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]]On Behalf Of
> Siddhartha Jain
> Sent: Tuesday, October 07, 2003 11:45 AM
> To: [email protected]
> Subject: Re: [VPN] IPSEC over UDP or TCP
> 
> 
> Advantages: Beats ISP blocking of IPSec traffic and
> overcomes NAT difficulties.
> 
> Cons: Decreases throughput because you have higher
> overheads. Original packet inside IPSec inside TCP/UDP
> packet.
> 
> 
> 
>  --- "Shivdasani, Meenoo"
> <[email protected]> wrote: >
> > I'm interested in people's experiences with
> > implementing IPSEC over UDP
> > or TCP.
> >
> > Benefits?  Disadvantages?
> >
> > Thanks in advance,
> >
> > M
> > _______________________________________________
> > VPN mailing list
> > [email protected]
> > http://lists.shmoo.com/mailman/listinfo/vpn
> 
> ________________________________________________________________________
> Want to chat instantly with your online friends?  Get the FREE Yahoo!
> Messenger http://mail.messenger.yahoo.co.uk
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn
> 
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn
-- 

-> Jean-Francois Dive
--> [email protected]

I think that God in creating Man somewhat overestimated his ability.
-- Oscar Wilde