Additional padding may be added to the Encapsulating Security Protocol (ESP) trailer to provide partial traffic flow confidentiality. ESP is a protocol that provides confidentiality, integrity, and authentication for IP packets. ESP uses encryption to protect the payload of the IP packets, and optionally the IP header as well.
ESP also adds a trailer at the end of the IP packet, which contains a padding field, a pad length field, and a next header field. The padding field is used to align the encrypted data to the block size of the encryption algorithm, and to provide partial traffic flow confidentiality by obscuring the actual length of the data. The pad length field indicates the number of bytes in the padding field. The next header field indicates the type of the payload that follows the ESP trailer. Data origin authentication, protection against replay attack, and access control are not provided by the ESP trailer, but by other components of ESP, such as the ESP header, the ESP authentication data, and the security association. References:
* Encapsulating Security Payload
* IPsec
* IPsec: ESP Trailer