In message <9702070347.AA07084@aurora.cis.upenn.edu>, you write: >Another point is that fragmentation checking should be done before any >IPsec handling takes place (easier and faster). All IPsec processing must be done above fragmentation. -Craig