The appliance's own traffic into an offloaded tunnel, in the association's lifetime, 2026-10-25
774: a packet an appliance itself sends into
an offloaded tunnel does not go through the transform the drivers interpose. ip_output hands it to the
kernel's own offload path (ipsec_accel_output), which tags it for the driver and records it only in a
software counter of its own (accel_lft_sw, reported apart as SADB_X_EXT_LFT_CUR_SW_OFFL); the
association's current lifetime - what its byte and packet limits, and strongSwan, read - grows only by
what the driver reports with ipsec_accel_drv_sa_lifetime_update. Neither driver reported the tagged
packets it encrypted, so for traffic the appliance originates the lifetime stood still.
The whole page, with how it was taken and what it does not show: The appliance's own traffic into an offloaded tunnel, in the association's lifetime, 2026-10-25.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.