Netfilter hooks, IPSec hooks etc.

I´ve got some questions.
1. Where does netfilter hook into the networking stack concerning the layer?
2. Where is the IPSec stack placed in the networking stack in kernels 2.6.x?
3. Where does netfilter interact with IPSec and why is it send twice through the hooks?

Perhaps someone has some answers. Thank´s in advance.