The TCP/IP Guide - IPSec Authentication Header (AH)

The format of the Authentication Header itself is described in Table 79 and shown in Figure 123.

**Table 79: IPSec Authentication Header (AH) Format**
Field Name	Size (bytes)	Description
*Next Header*	1	*Next Header:* Contains the protocol number of the next header after the AH. Used to link headers together.
*Payload Len*	1	*Payload Length:* Despite its name, this field measures the length of the authentication header itself, not the payload. (I wonder what the history is behind that!) It is measured in 32 bit units, with 2 subtracted for consistency with how header lengths are normally calculated in IPv6.
*Reserved*	2	*Reserved:* Not used; set to zeroes.
*SPI*	4	*Security Parameter Index (SPI):* A 32-bit value that when combined with the destination address and security protocol type (which here is obviously the one for AH) identifies the security association to be used for this datagram. See the topic on security associations for more details.
*Sequence Number*	4	*Sequence Number:* This is a counter field that is initialized to zero when a security association is formed between two devices, and then incremented for each datagram sent using that SA. This uniquely identifies each datagram on an SA and is used to provide protection against replay attacks by preventing the retransmission of captured datagrams.
*Authentication Data*	Variable	*Authentication Data:* This field contains the result of the hashing algorithm performed by the AH protocol, the Integrity Check Value (ICV).

The size of the Authentication Data field is variable to support different datagram lengths and hashing algorithms. Its total length must be a multiple of 32 bits. Also, the entire header must be a multiple of either 32 bits (for IPv4) or 64 bits (for IPv6), so additional padding may be added to the Authentication Data field if necessary.

You may also notice that no IP addresses appear in the header, which is a prerequisite for it being the same for both IPv4 and IPv6.