Which component of the data packets is encrypted in Transport mode encryption of an IPsec server?

In IPsec's Transport mode, only the payload of the IP packet (i.e., the upper-layer protocol data, such as a TCP segment) is encrypted and/or authenticated. The original IP header is not encrypted, allowing intermediate routers to read the source and destination addresses for routing. An IPsec header (specifically, the Encapsulating Security Payload - ESP header) is inserted between the original IP header and the payload. This mode is typically used for end-to-end communication between two hosts.

B. The original IP header is explicitly left unencrypted in Transport mode to ensure the packet can be routed across the internet.
C. Encrypting both the header and payload is characteristic of IPsec Tunnel mode, not Transport mode. Tunnel mode encapsulates the entire original IP packet.
D. IPsec is a framework of protocols specifically designed to provide security, including confidentiality through encryption, at the IP layer.

- Kent, S., & Seo, K. (2005). RFC 4301: Security Architecture for the Internet Protocol. The Internet Society. Section 4.2 describes Transport Mode, stating it provides protection primarily for upper-layer protocols, not the IP header.

- Kent, S. (2005). RFC 4303: IP Encapsulating Security Payload (ESP). The Internet Society. Section 2.2, "Transport Mode," specifies that the ESP header is inserted after the IP header and before an upper-level protocol header, protecting the data that follows.

- Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 20, "IP Security," details the differences between Transport and Tunnel modes, specifying that Transport mode encrypts the transport-layer segment.