In transport mode only the IP data are encrypted, not the IP headers. This allows intermediate nodes to read the source and destination addresses. In tunnel mode the entire IP packet is encrypted and is then placed into the content portion of another IP packet. This requires other systems at the beginning and end of the tunnel to act as proxies and to send and receive the encrypted packets. These systems then transmit the decrypted packets to their true destinations