diff --git a/.gitmodules b/.gitmodules
index 8bdf7cbc..8d6f17c9 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -3,7 +3,7 @@
 	url = https://github.com/weaveworks/build-tools
 [submodule "vendor/github.com/vishvananda/netlink"]
 	path = vendor/github.com/vishvananda/netlink
-	url = https://github.com/brb/netlink.git
+	url = https://github.com/weaveworks/netlink.git
 [submodule "vendor/github.com/gorilla/mux"]
 	path = vendor/github.com/gorilla/mux
 	url = https://github.com/gorilla/mux.git
diff --git a/docs/fastdp-crypto.md b/docs/fastdp-crypto.md
index fc381485..af2476a9 100644
--- a/docs/fastdp-crypto.md
+++ b/docs/fastdp-crypto.md
@@ -126,7 +126,10 @@ iptables -t filter -A OUTPUT ! -p esp -m policy --dir out --pol none \
          -m mark --mark ${MARK} -j DROP
 ```
 
-# Misc
+## ESN
+
+To prevent from cycling SeqNo which makes replay attacks possible, we use
+64-bit extended sequence numbers known as [ESN](esn).
 
 ## MTU
 
diff --git a/net/ipsec/ipsec.go b/net/ipsec/ipsec.go
index 97074b19..3e60603a 100644
--- a/net/ipsec/ipsec.go
+++ b/net/ipsec/ipsec.go
@@ -195,7 +195,6 @@ func (ipsec *IPSec) Destroy(localPeer, remotePeer mesh.PeerName, connUID uint64,
 	defer ipsec.Unlock()
 
 	// Destroy inbound
-	ipsec.log.Infof(">>>>>>>>>>>>>>>>>> DESTROY <<<<<<<<<<<<<<<<<<<<<<")
 
 	if inSPIInfo, ok := ipsec.spiInfo[inSPIID]; ok {
 		ipsec.log.Infof("ipsec: destroy: in %s -> %s 0x%x", remoteIP, localIP, inSPIInfo.spi)
@@ -444,7 +443,8 @@ func xfrmAllocSpiState(srcIP, dstIP net.IP) *netlink.XfrmState {
 		Dst:          dstIP,
 		Proto:        netlink.XFRM_PROTO_ESP,
 		Mode:         netlink.XFRM_MODE_TRANSPORT,
-		ReplayWindow: 32,
+		ReplayWindow: 256,
+		ESN:          true,
 	}
 }
 
diff --git a/vendor/github.com/vishvananda/netlink b/vendor/github.com/vishvananda/netlink
index c540d7a6..1109360b 160000
--- a/vendor/github.com/vishvananda/netlink
+++ b/vendor/github.com/vishvananda/netlink
@@ -1 +1 @@
-Subproject commit c540d7a60a21b09073f88af3af4549abdf331abb
+Subproject commit 1109360bd758658336ec9641bcff5c626a40e8a1