MACsec 802.1AE header (SecTAG)

The 802.1AE header has a security tag (SecTAG) which includes:

• the association number within the channel

• the packet number to provide a unique initialization vector for encryption and authentication algorithms, as well as protection against replay attack

• an optional LAN-wide secure channel identifier

The SecTAG is identified by the MACsec Ethertype and includes the following fields:

• TAG Control Information (TCI)

• Association Number (AN)

• Short Length (SL)

• Packet Number (PN)

• Optionally-encoded Secure Channel Identifier (SCI)

The following figure shows the format of the SecTAG.

Figure: SecTAG format