IPsec Packet Builder 2D: AH vs ESP, Transport vs Tunnel, NAT Traversal

Every IPsec-protected packet is built from the same two choices: which header protects it (AH for integrity only, ESP for encryption) and which mode wraps it (Transport, which keeps the original IP header on the wire, or Tunnel, which encapsulates the whole original packet inside a fresh one for gateway-to-gateway VPNs). This 2D simulator renders that packet as a byte-proportional stack of header blocks travelling across a network path from a source host to a destination host, with a togglable NAT router in the middle and a live byte-accurate breakdown panel underneath. Switch AH on with NAT enabled and watch the receiver's integrity check fail and the packet get dropped — because AH's authentication hash covers the very IP addresses NAT has to rewrite. Switch to ESP and the packet survives, automatically picking up an 8-byte NAT-Traversal UDP wrapper so the NAT device has a port to translate. Drag the packet along the wire to scrub to any point manually, or drag the payload-size slider to watch every header layer resize live. Live readouts track the original payload size, the total wire size after encapsulation, the IPsec overhead in bytes and percent, and the pass/fail state of the integrity check at the receiver.