Question on IPSec and AH/ESP using protocols #'s

JockVSJock

So I'm reading Darril Gibson's Security+ book, and he is talking about IPSec and how it can be broken down to AH and ESP. He then goes on to say that AH uses protocol ID 51 and ESP uses protocol ID 51.

However he never goes into the why. Can anyone explain why they are using protocol #'s Vs a port #?

thanks

fieldmonkey

I'm not really sure, just taking a stab at it! Hopefully someone else can shed some more light on it, as I pondered this for a minute myself. Then I thought, well I only need to know the important stuff, right?

The router / server needs to identify what protocol that is in the packet to determine how to process it...

Since AH (51) is doing the "authenticating" it would need to know how to proceed with the data to process the authentication. Additionally with the ESP (50), doing the "encrypting" it is being used to identify that the following data needs to be encrypted / decrypted.


Like I started, just taking a stab at it... but found this that discusses both. I hope this helps.