In message <>, you write: >Another point is that fragmentation checking should be done before any >IPsec handling takes place (easier and faster). All IPsec processing must be done above fragmentation. -Craig