> Should this message be sent when a packet does not conform to the local > security policy database (spd), or should such packets be silently dis- > carded? IMHO, it should be up to the system's policy as to whether or not ICMP unreachables (and, if so, *which* type of unreachable) should be sent. - Bill