TCP/IP Tutorial and Technical Overview - IBM Redbooks

22.4.2 Authentication Header (AH)
AH is used to provide integrity and authentication to IP datagrams. Replay
protection is also possible. Although its usage is optional, the replay protection
service must be implemented by any IPSec-compliant system. The services are
connectionless, that is, they work on a per-packet basis. AH is used in two
modes, transport mode and tunnel mode.
AH authenticates as much of the IP datagram as possible. In transport mode,
some fields in the IP header change en-route and their value cannot be predicted
by the receiver. These fields are called mutable and are not protected by AH.
The mutable IPv4 fields are:
► Type of service (TOS)
► Flags
► Fragment offset
► Time to live (TTL)
► Header checksum
When protection of these fields is required, tunneling must be used. The payload
of the IP packet is considered immutable and is always protected by AH.
AH is identified by protocol number 51, assigned by the IANA. The protocol
header (IPv4, IPv6, or extension) immediately preceding the AH contains this
value in its protocol (IPv4) or Next header (IPv6, extension) field.
AH processing is applied only to non-fragmented IP packets. However, an IP
packet with AH applied can be fragmented by intermediate routers. In this case,
the destination first reassembles the packet and then applies AH processing to it.
If an IP packet that appears to be a fragment (offset field is non-zero, or the More
Fragments bit is set) is input to AH processing, it is discarded. This prevents the
so-called overlapping fragment attack, which misuses the fragment reassembly
algorithm in order to create forged packets and force them through a firewall.
Packets that fail authentication are discarded and never delivered to upper
layers. This mode of operation greatly reduces the chances of successful
denial-of-service attacks, which aim to block the communication of a host or
gateway by flooding it with bogus packets.
Chapter 22. TCP/IP security 813