In your previous mail you wrote: In theory one could apply IPSEC to IPv6 fragments in transport mode. => I disagree: IPv6 fragmentation is done by an extension header, this is not a "upper layer protocol" so you can't select it. So even in theory it is impossible. Regards Francis.Dupont@enst-bretagne.fr