I think the processing order is just wrong. Keying should be done before sending TCP data, i.e. the event that triggers keying must happen before invoking TCP or very early in the TCP open processing. Hilarie