- IPSec is just an encrypted IP packet
- Meaning everything after IP header is encrypted
- Well, there is also AH header between IP header and encrypted contents
- The AH header specifies how the content is encrypted
- If AH matches on client and receiver, the packet is passed to decryption
- What happens when the packet is decrypted depends on packet handler on receiving side
https://libreswan.org/wiki/images/e/e0/Netdev-0x12-ipsec-flow.pdf