>"I have not turned on Security or I am not USING Security at this node". How about an ICMP Protocol Unreachable message? This has the definite advantage of already being implemented both for the encapsulation protocol and for the UDP port used for key management... Phil