ort and tunnel modes For transport mode, the AH or ESP header is inserted between the IP header and the source IP packet payload. In the IPv6 environment, the AH or ESP header appears after the Hop-by-Hop, Destination, Routing and Fragment extensions. For tunnel mode, the AH or ESP header encapsulates the source IP packet, and the whole is encapsulated in its turn by a new IP header. The tunnel corresponds to a data structure, in which an IP packet contains another IP packet. When the AH header is used, authentication is applied to the whole packet except for the variable fields of the IP header (Figure 7.3). Source IPv4 packet IPv4 header + options Transport mode IPv4 header + options Authenticated packet, except variable field in IPv4 header + options Tunnel mode New IPv4 header + options IPv4 header + options Authenticated packet, except variable fields in the new IPv4 header + options Source IPv6 packet IPv6 header Extensions Transport mode IPv6 header Extensions Authenticated packet, except variable field in IPv6 header + extensions Tunnel New IPv6 header Extensions IPv6 header Extensions Authenticated packet, except variable fields in the new IPv6 header + extensions Figure 7.3. Position of AH extension 130 Wi-Fi Integration to the 4G Mobile Network The variable fields of the IPv4 header are set at ZERO to calculate the authentication digest: - DSCP (DiffServ Code Point): the value of this field can be modified by an intermediary router when it checks traffic characteristics; - ECN (Explicit Congestion Notification): the value of this field can be modified by an intermediary router to alert the destination that congestion is developing; - DF (Don't Fragment): this bit can be set at ONE by an intermediary router; - Fragment Offset: insertion of the AH header occurs on non-fragmented IP packets, and, therefore, this field has a value of zero; - TTL (Time To Live): the value of this field is decreased by one unit for each router crossed; - Checksum: the value of this field is recalculated as soon as a field in