IPsec Tunnel vs Transport Mode: AH/ESP Packet Encapsulation

Every IPsec-protected packet is built from the same two choices: which header protects it (AH for integrity only, ESP for encryption) and which mode wraps it (Transport, which keeps the original IP header on the wire, or Tunnel, which encapsulates the whole original packet inside a fresh one for gateway-to-gateway VPNs). This simulator renders that packet as a byte-proportional stack of header blocks travelling across a 3D network path from a source host to a destination host, with a togglable NAT router in the middle. Switch AH on with NAT enabled and watch the receiver's integrity check fail and the packet get dropped — because AH's authentication hash covers the very IP addresses NAT has to rewrite. Switch to ESP and the packet survives, automatically picking up an 8-byte NAT-Traversal UDP wrapper so the NAT device has a port to translate. Live readouts track the original payload size, the total wire size after encapsulation, the IPsec overhead in bytes and percent, and the pass/fail state of the integrity check at the receiver.