diff --git a/libi2pd/SSU2.cpp b/libi2pd/SSU2.cpp
index 25dc7d8a..52bba127 100644
--- a/libi2pd/SSU2.cpp
+++ b/libi2pd/SSU2.cpp
@@ -6,6 +6,8 @@
 * See full license text in LICENSE file at top of project tree
 */
 
+#include <string.h>
+#include <openssl/rand.h>
 #include "Transports.h"
 #include "SSU2.h"
 
@@ -37,22 +39,34 @@ namespace transport
 		uint8_t sharedSecret[32];
 		m_EphemeralKeys->Agree (m_Address->s, sharedSecret);
 		m_NoiseState->MixKey (sharedSecret);
-		
-		uint8_t packet[1200]; // TODO: correct packet size
-		size_t packetSize = 64;
+
+		Header header;
+		uint8_t headerX[48], payload[1200]; // TODO: correct payload size
+		size_t payloadSize = 8;
 		// fill packet
-		memcpy (packet + 32, m_EphemeralKeys->GetPublicKey (), 32); // X
+		RAND_bytes (header.h.connID, 8);
+		memset (header.h.packetNum, 0, 4);
+		header.h.type = eSSU2SessionRequest;
+		header.h.flags[0] = 2; // ver
+		header.h.flags[1] = 2; // netID TODO:
+		header.h.flags[2] = 0; // flag
+		RAND_bytes (headerX, 8); // source id
+		memset (headerX + 8, 0, 8); // token
+		memcpy (headerX + 16, m_EphemeralKeys->GetPublicKey (), 32); // X
 		// encrypt
-		CreateHeaderMask (m_Address->i, packet + (packetSize - 24), m_Address->i, packet + (packetSize - 12));
-		EncryptHeader (*(i2p::crypto::ChipherBlock *)packet);
-		uint8_t nonce[12] = {0};
-		i2p::crypto::ChaCha20 (packet + 16, 48, m_Address->i, nonce, packet + 16);
-		i2p::crypto::AEADChaCha20Poly1305 (packet + 64, packetSize - 64, m_NoiseState->m_H, 32, m_NoiseState->m_CK, nonce, packet + 64, packetSize - 48, true);
+		const uint8_t nonce[12] = {0};
+		i2p::crypto::AEADChaCha20Poly1305 (payload, payloadSize, m_NoiseState->m_H, 32, m_NoiseState->m_CK + 32, nonce, payload, payloadSize + 16, true);
+		payloadSize += 16;
+		CreateHeaderMask (m_Address->i, payload + (payloadSize - 24), m_Address->i, payload + (payloadSize - 12));
+		EncryptHeader (header);
+		i2p::crypto::ChaCha20 (headerX, 48, m_Address->i, nonce, headerX);
+		
 	}	
 
-	void SSU2Session::EncryptHeader (i2p::crypto::ChipherBlock& header)
+	void SSU2Session::EncryptHeader (Header& h)
 	{
-		header ^= m_HeaderMask;
+		h.ll[0] ^= m_HeaderMask.ll[0];
+		h.ll[1] ^= m_HeaderMask.ll[1];
 	}	
 
 	void SSU2Session::CreateHeaderMask (const uint8_t * kh1, const uint8_t * nonce1, const uint8_t * kh2, const uint8_t * nonce2)
diff --git a/libi2pd/SSU2.h b/libi2pd/SSU2.h
index 3c0dc843..7c1deefc 100644
--- a/libi2pd/SSU2.h
+++ b/libi2pd/SSU2.h
@@ -19,9 +19,27 @@ namespace i2p
 namespace transport
 {
 	const int SSU2_TERMINATION_TIMEOUT = 330; // 5.5 minutes
+
+	enum SSU2MessageType
+	{
+		eSSU2SessionRequest = 0
+	};
 	
 	class SSU2Session: public TransportSession, public std::enable_shared_from_this<SSU2Session>
 	{
+		union Header
+		{
+			uint64_t ll[2];
+			uint8_t buf[16];
+			struct
+			{
+				uint8_t connID[8];
+				uint8_t packetNum[4];
+				uint8_t type;
+				uint8_t flags[3];
+			} h;
+		};
+	
 		public:
 
 			SSU2Session (std::shared_ptr<const i2p::data::RouterInfo> in_RemoteRouter = nullptr,
@@ -31,7 +49,7 @@ namespace transport
 		private:
 
 			void SendSessionRequest ();
-			void EncryptHeader (i2p::crypto::ChipherBlock& header);
+			void EncryptHeader (Header& h);
 			void CreateHeaderMask (const uint8_t * kh1, const uint8_t * nonce1, const uint8_t * kh2, const uint8_t * nonce2);
 		
 		private:
@@ -40,7 +58,11 @@ namespace transport
 			std::unique_ptr<i2p::crypto::NoiseSymmetricState> m_NoiseState;
 			std::shared_ptr<const i2p::data::RouterInfo::Address> m_Address;
 
-			i2p::crypto::ChipherBlock m_HeaderMask;
+			union 
+			{
+				uint64_t ll[2];
+				uint8_t buf[16];
+			} m_HeaderMask;
 	};
 }
 }