WCF binding security mode in app config is confusing

I am confused by some of the security settings in WCF, when you are making configuration settings in the host app config.  The issue centers on the following nodes:
<binding>
  <security mode = "" >
     <transport ...  />
     <message .... />

Learning WCF, by Bustamante, says that the defaults for wsHttpBinding and netTcpBinding are:

<binding>    <!-- for wsHttpBinding  -->
  <security mode = "Message" >
     <transport ...  />
     <message .... />

<binding>    <!-- netTcpBinding  -->
  <security mode = "Transport" >
     <transport ...  />
     <message .... />

What confuses me is why are both <transport> and <message> used?  For all the other standard bindings defaults the @mode value and the child element to <security> match up one-to-one.  (If mode=Message then they use security/message; if mode=transport, then they use security/trnasport)

I guess I dont understand the meaning of <security mode="" >   The text (and msdn) explains "mode" with statements like, "this configures the binding for transport security" or "this configures the binding for message security"

What are the meanings of security/@mode and security/transport and security/message; and how do the interact and/or depend on each other?