4. AH authentication header

The Authentication Header (AH) , considered optional in , guarantees the receiver of an IP packet that the sender's identity is as declared in the packet. It also guarantees the receiver that no one has modified the contents of a packet during its transfer over the network. Optionally, it can be used to detect whether the packet has been replayed by a malicious person.

To provide all these services, an authenticator must be added to the transmitted IP packet, whose validity will be verified by the receiving security equipment.

To ensure that network modifications do not result in a large number of legitimate packets being rejected by the receiving security equipment, the authenticator must be calculated on fields that are certain not to be modified by the network (see §