title: Purpose of the selector in ip xfrm state add
body: <p>What does the selector (parameter sel) in the "ip xfrm state add" command achieve?</p>
  
  <p>The source and destination addresses (and additional parameters like ports and protocol) are set in the ID section, but the selector contains a supplementary set of these. Example:</p>
  
  <pre><code>   ip xfrm state add src 10.0.0.1 dst 10.0.0.2 proto esp spi 123456 sel src 10.0.0.3 dst 10.0.0.4 enc blowfish  0xaabbccddee
  </code></pre>
  
  <p>This leads to the following result:</p>
  
  <pre><code>    src 10.0.0.1 dst 10.0.0.2
  proto esp spi 0x0001e240 reqid 0 mode transport
  replay-window 0 
  enc cbc(blowfish) 0xaabbccddee
  sel src 10.0.0.3/32 dst 10.0.0.4/32 
  </code></pre>
  
  <p>Setkey seemingly does not have the opportunity to add such a selector value. It also does not show selectors in the output. The xfrm command from above produces the following "setkey -D" output:</p>
  
  <pre><code>   10.0.0.1 10.0.0.2 
  esp mode=transport spi=123456(0x0001e240) reqid=0(0x00000000)
  E: blowfish-cbc  aabbccdd ee
  seq=0x00000000 replay=0 flags=0x00000000 state=mature 
  created: Nov 26 01:25:39 2013   current: Nov 26 01:26:07 2013
  diff: 28(s) hard: 0(s)  soft: 0(s)
  last:                       hard: 0(s)  soft: 0(s)
  current: 0(bytes)   hard: 0(bytes)  soft: 0(bytes)
  allocated: 0    hard: 0 soft: 0
  sadb_seq=0 pid=6959 refcnt=0
  </code></pre>
  
  <p>So what does the IPsec subsystem eventually do with this selector?</p>