The authentication header (AH) is an additional header added directly after the IP header to provide packet authentication.

ESP protects the entire inner IP packet and header.

For those of you who already know how to read a UDP packet header, chapter 3 is your starting point.