>With 466MHz Celeron CPUs and decent network hardware (3c905B) the most
>throughput I seem to be able to force through our IPsec is about 1.5MB/sec
>(that's mega *bytes*, not bits).  Though I'm told by several people that
>this is not atypical for a software-only IPsec implementation, I don't
>understand _why_.

	see KAME PR 229.
	http://orange.kame.net/dev/query-pr.cgi?pr=229

	basically, blowfish uses very big intermediate data and we cant
	hold it on the stack.  we endup using static memory pool and
	hence we need spl locks.  we'll try to correct it.

itojun