Recognize the later Key and Sequence extensions
05RFC 2890 updates RFC 2784 by restoring optional four-byte Key and Sequence Number fields. They do not change GRE version0 into a new protocol version.
Separate security view: knowing visible Key7 does not authenticate a packet. RFC 2890 requires IP security protection against forged sequence numbers; it is not supplied by the Key field.
Source for this drawing: RFC 2890 · Read RFC section 2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
RFC 2890 restores Key and Sequence fields using bits2/3 while retaining GRE version0. This is a formal update, not an obsoletion.
Read the updated RFC section ↗A GRE Key identifies a flow; it is not a secret or an authentication key.
- K at bit2 and S at bit3 independently indicate the optional Key and Sequence fields. In wire order, an optional checksum/Reserved1 pair comes before Key, then Sequence.
- The Key supplies flow context. With K set, sequence state is specific to that key’s flow. How a Key is obtained is outside RFC 2890.
- The Sequence Number MUST be used to establish transmit order. The counter starts at0 and wraps modulo2^32. Packets without S may be interleaved with sequenced packets.
- Out-of-sequence packets SHOULD be silently discarded. A gap may be buffered for a small interval; if buffered to OUTOFORDER_TIMER, the receiver MUST immediately drain expired packets in order, ignoring remaining gaps. This is unreliable ordering, not retransmission.
- RFC 2890 section3 requires IP security protection of the GRE header and payload against sequence-number injection; ESP or AH MUST protect the GRE header. ESP is Encapsulating Security Payload; AH is Authentication Header. The Key itself provides no security.
The diagram is an explicit RFC 2890 extension profile, not an unmodified RFC 2784 receiver accepting deprecated bits. Sequence comparison is bounded modular classification; timers, reordering queues and IPsec are explained but not implemented. No invented timeout or buffer limit is prescribed.
Read RFC 2890 section 2 ↗