ral data streams over the same TCP connection. 6.12 CONFIDENTIALITY AND INTEGRITY BY IPsec The Internet protocol security (IPsec) provides a set of protocols and a robust mechanism to provide security to the Internet protocol (IP). The protocol is a cornerstone when building VPNs. IPsec forms a secure layer from one network node to another, protecting all IP packets concerned at the IP layer (it does not protect individual applications from attacks). It is rather an extensive standard, which has become part of the IPv6 standard. For IPv4 it is optional. IPsec provides: Confidentiality Integrity Authenticity Non-replay protection Different IPsec security levels are available through various modes and security proto- cols. IPsec can be used in two modes: Transport mode (not common) Tunnel mode Security Security gateway Ipsec tunnels Security gateway Figure 6.23 IPsec tunnels starts and ends at security gateways or hosts Transport Application New headers IPsec Payload data Figure 6.24 The encapsulation of the original IP packet into a tunnel The tunnel mode allows an IPsec entity to encapsulate, encrypt and forward IP packets through a logical point-to-point tunnel to another IPsec entity. The tunnel mode encapsu- lates the entire IP header and the payload. See Figures 6.23 and 6.24. The tunnel mode is normally used between two machines when at least one of the machines is not an end point of the connection. For example, IPsec in the tunnel mode can be deployed between two firewalls located between a client and a server. The major advantage of the tunnel mode is that an attacker can only determine the tunnel end points and not the true source and destination of the tunnelled packets. Thus the tunnel mode protects against traffic analysis. Another advantage of the tunnel mode is that if offers tunnelling of IP packets with private IP addresses in IP packets with public IP addresses. Thus, the IPsec tunnel mode offers some solutions to the addressing problem. 6.12.1 TRANSPORT MODE The transport mode (Figure 6.25) shou