Based on this packet, which of the following is correct?

Question

Options

• AThe packet must be an IPsec VPN packet encapsulated with only AH
• BThe protocol number is 51, which means that the message after the IP Header is the AH header
• CThe protocol number is 51, which means that the message after the IP Header is the ESP header
• DThe packet must an IPsec VPN message, and the data part of the message is encrypted

• A
  14% (4)
• B
  79% (22)
• C
  4% (1)
• D
  4% (1)

Explanation

Protocol number 51 is the IANA-assigned identifier for the IPsec Authentication Header (AH), meaning the IP header's "Next Protocol" field of 51 tells the receiving host that an AH header immediately follows the IP header - making B correct.

Why the distractors fail:

• A is too restrictive - protocol 51 confirms AH is present, but does not rule out AH being combined with ESP (e.g., in a nested tunnel); "only AH" cannot be determined from the protocol number alone.
• C confuses the two IPsec protocols - ESP uses protocol number 50, not 51.
• D is wrong because AH provides authentication and integrity only - it does not encrypt the payload. Encryption requires ESP (protocol 50).

Memory tip: Think "50 = ESP = Encrypted" (both E words) and "51 = AH = Authenticated only" - one number apart, completely different jobs. If you need encryption, you need 50, not 51.

No community discussion yet for this question.