Hi everbody,
As per RFC 4303, ESP header:
Note the location of NEXT HEADER above, it is attached after ENCRYPTED PAY LOAD.
Below is the Wireshark with decoded ESP payload , ESP is being used in tunnel mode:
https://ask.wireshark.org/questions/12019/how-can-i-decrypt-ikev1-andor-esp-packets
The following screenshot is taken from the above link:
Note " next header" in capture appears before the payload which makes sense because the receiving device needs to know the what is next pay laod after the header but it does not match the header in RFC 4303.
Thanks and have a nice day!!
