TCP/IP Tutorial and Technical Overview - IBM Redbooks

This is a variable-length field that contains the Integrity
Check Value (ICV) for this packet. The field must be an
integral multiple of 32 bits (IPv4 or IPv6) in length. All
implementations must support such padding and must
insert only enough padding to satisfy the IPv4/IPv6
alignment requirements.
Encapsulating Security Payload
The Encapsulated Security Payload (ESP) is defined in RFC 4303. All data
following the ESP header is encrypted. Figure 9-12 illustrates the ESP structure
with the additional field explained after the figure.
The packet begins with the Security Parameters Index (SPI) and Sequence
Number (SN). Following these fields is the Payload Data, which has a
substructure that depends on the choice of encryption algorithm and mode and
on the use of TFC padding. Following the Payload Data are Padding and Pad
Length fields and the Next Header field. The optional Integrity Check Value (ICV)
field completes the packet.
Figure 9-12 IPv6 ESP
Where:
Security Parameters Index (SPI)
Sequence Number Field
Payload
Padding
Integrity Check Value-ICV
Next Header Length
Payload Data Payload Data is a variable-length field containing data
(from the original IP packet). It is a mandatory field and is
an integral number of bytes in length.
Chapter 9. IP version 6 349