Please excuse the silliness. The next header field in ESP contains an 8-bit value to represent the header contained within the encrypted payload. So, this is how I read it, please verify the following for me: ESP used in tunnel mode -next header = 4 for IP-in-IP ESP used in transport mode -next header = 6 for TCP. True or false? Or is it reversed? A very grateful thank you in advance. -jim