Should this document say anything about the difficulty of packet classification in the presence of IPsec? --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)