Figure 2 Encapsulating Security Payload (ESP) transformation, showing (a) original IP (IPv4) datagram, (b) transport mode encapsulation with checksum coverage, (c) tunnel mode with encapsulation of original datagram.