ted counters in today's sessions should be in the 10,000s. Address Tunneling Before the word firewall became a household name in the 1990s, protocol-sensitive hardware encryp- tors operating at the data link layer and positioned at gateway positions between LAN and the WAN pioneered the concept of masking addresses to protect end stations. The concept was easily expanded to the IP layer with IP-level encryption and has by now been institutionalized by IPsec in one of its operational modes. Instead of encrypting just the payload of the packet, the addresses are also encrypted, SO the real source and destination are not publicly visible to the routers and switches in network infrastructure. New default addresses are created and prefixed (as opposed to appended) as new headers to the encrypted packet. The appropriate new trailers are calculated and attached. In addition to encryption, this process therefore encapsulates the original packet (along with its headers and trailers) inside a new packet, which behaves like an envelope and can be easily routed by the IP network routers without a problem. The encapsulating packet can have its payload encrypted (a second superposed time) by the encap- sulating mechanism, and the original packet can be tunneled inside the externally encrypted process. Upon arrival at the destination, the encapsulation is stripped away, the top-level packet is decrypted, and the new packet that appears beneath it from the tunnel with the intended destination addresses is steered accordingly to the correct destination by the use of translation tables that map, for instance, external to internal addresses, which must remain invisible to the WAN. Timestamp (Nonrepudiation) As mentioned earlier, events such as counters must sometimes be associated with specific windows in time. Some transmissions also require a good indication of the moment in time that they were ini- tiated or executed. Timestamping is a generic term that embeds a reading of time in a time-sensitive message. The significance of th