Validation of network communication tunnels

This invention is directed to the field of computer networks. It is more particularly directed to network devices that transform packets traveling in an IP network in various manners. This invention provides methods and apparatus for validating that transformations that are expected to occur in an IP network are indeed occurring as expected. Generally, these transformations establish logical communication tunnels within an IP network between the devices that perform the transformation and the devices that perform the reverse transformation. The invention is useful to validate the configuration of devices that support a variety of IP transformation methods, including IP-security protocols using the standard Encrypted Secure Payload protocol and Authenticated Header protocols as defined by the IETF. The invention is particularly useful to validate cases in which transformations occur on the full path of a packet traversing between two machines in an IP network, or when the transformations only occur on part of this path.