At a university, student traffic is wrapped in an extra IP header before it leaves a research tunnel, and the outside sensor shows a tunnel address rather than the student's address. What visibility impact explains that result?
Select an answer to reveal the explanation.
Short Explanation
Mail inside a second envelope shows the outer post office, not the letter writer's home address. You are seeing encapsulation hide the student address in the outside header. The trap is a mail filter, a password change, or a host firewall rewriting DNS.
Full Explanation
Encapsulation adds an outer IP header. On the outside of the research tunnel, the source address the sensor records is a tunnel endpoint, not the student host that sits inside. The inner header can still carry the student address, and the outside header does not. "Encapsulation, so the outside header carries a tunnel address rather than the student's address". The extra header is why the outside source is a tunnel address rather than the student address. "The outside sensor is only a mail filter and does not inspect student research traffic on the tunnel". A mail filter would explain missing mail content, not an IP source field on tunneled research traffic. The sensor result is about the outer address. "A password change on the student account rewrote the outer IP header of every packet from the lab". Changing a password updates an authentication secret. It does not rewrite the outer IP header of lab packets. "A host firewall on the student laptop rewrote DNS and removed the student address from the packet". Rewriting DNS changes name lookups. It does not wrap the student traffic in a second IP header or replace the outside source with a tunnel endpoint. Exam caveat: this stem is an added IP header, so the miss is the outer address. Do not treat the inner address as deleted from the packet. Operational check: on a capture that includes both headers, compare the outer source with the inner source and confirm they are different addresses.