While not listed in 2401 explicitly, couldn't one use ICMP/ICMPv6 type and code as a selector for a security association? The implementation wouldn't be that tough; just overload the already-there port fields for type and code. Thanks again, Dan