The attack fails
An eavesdropper on the internet copies every packet between two offices. With IPsec each copy is a locked envelope: it shows the two gateway addresses, never the computers, ports or data inside. Here is how that lock is built.
IKEv2 builds the tunnel
Gateway A starts IKEv2, the Internet Key Exchange, on UDP port 500. It offers algorithms, a random nonce and a Diffie–Hellman public value; Gateway B answers with its own. Each side mixes in its private value and gets the same secret, which never travels.
Now encrypted, each gateway proves its identity with a certificate signature or a pre-shared key. They also agree what the tunnel protects: traffic between 192.168.1.0/24 and 192.168.2.0/24. That is 4 messages, two round trips.
Each gateway now holds two security associations (SAs), one per direction. An SA is a set of keys and rules plus a 32-bit number, the SPI, that names it. A counter numbers every packet sent.
ESP carries the packet
The office laptop 192.168.1.10 sends a normal packet to the server 192.168.2.20. It knows nothing about the VPN: it just hands the packet to its default gateway, Gateway A.
The destination matches the tunnel, so Gateway A puts the whole packet, header and all, inside ESP (Encapsulating Security Payload). It encrypts it, adds the SPI, sequence number 1 and an integrity tag, then a new outer header.
The eavesdropper copies it. It can read only the outer header (two gateway addresses, protocol 50 = ESP), the SPI, the sequence number, the size and the timing. Who is talking inside, and what they say, stays hidden.
Gateway B finds the SA by its SPI, checks the sequence number and the integrity tag, and decrypts. It throws away the outer header and forwards the original packet, unchanged, into office B.
The server receives the packet from 192.168.1.10 exactly as it was sent. To both offices the tunnel feels like one hop between two private networks, even though it crossed the public internet.
The attacker sends two copies. One is replayed unchanged: its sequence number, 1, was already seen, so Gateway B drops it. In the other it changes bytes and the number, but without the key it cannot make a matching tag. Dropped too.
Other kinds of VPN
If the laptop and the server ran IPsec themselves, they could use transport mode: their own IP header stays outside and only the part after it is encrypted. Tunnel mode is for gateways protecting whole networks.
A remote-access VPN is the same idea for one person. The home laptop runs IKEv2 straight to Gateway B, gets an office address, 192.168.2.200, and wraps its office traffic in tunnel mode. The eavesdropper still sees only a locked envelope.
The packet, field by field
;; step 1/12 · tap-fails · preview ;; gateway a → gateway b what the eavesdropper records: outer IPv4 198.51.100.10 → 203.0.113.20 protocol 50 (ESP) SPI 0x3a5f1c27 · sequence 1 · 176 bytes · timing what it cannot read or change unnoticed: 192.168.1.10 → 192.168.2.20, TCP ports, the data
Tunnel mode with AES-GCM adds 54–57 bytes to every packet: a 20-byte outer header, 8 bytes of SPI and sequence number, an 8-byte IV, 0–3 bytes of padding, 2 trailer bytes and a 16-byte tag. If a gateway or laptop is behind NAT, IKEv2 notices and moves to UDP port 4500, carrying ESP inside UDP so the NAT can track it (RFC 3948).