A host applies IPsec authentication that covers its TCP segment but leaves the original IP header outside the protected span. Which mode is in use?
A host applies IPsec authentication that covers its TCP segment but leaves the original IP header outside the protected span. Which mode is in use?
Answer
Transport mode
Options - A. Transport mode - B. Tunnel mode - C. Association mode - D. Cipher mode Why - A. Correct. Transport mode covers the payload — the TCP or UDP segment — and leaves the original IP header outside the protection. - B. Tunnel mode would cover the entire original packet, IP header included, inside a new outer packet. - C. Not an IPsec mode. "Association" belongs to security association, a different concept. - D. Not an IPsec mode. A cipher has modes of operation, but that is a block-cipher term. Apply the coverage rule rather than a memorised slogan: transport wraps the payload, tunnel wraps the whole packet. This question and its mirror are both on the paper, and only the rule answers both.
Stallings & Brown 5e ch22 §22.5