AH-style authentication authenticates the entire IP packet, including the outer IP header, while the ESP authentication mechanism authenticates only the IP datagram portion of the IP packet . Either protocol can be used alone to protect an IP packet, or both protocols can be applied together to the same IP packet.