The length of the ICV is deternined by the integrity/authenticity algorithm selected for the SA. The default algorithms for use with both AH and ESP use exaclty 96 bits, as a result of truncating the larger HMAC output, but that truncation is specified in the algorithm definitions, as profiled for use in the IPsec context. Steve