> >> 	we currently do show them via "setkey -DP".
> >no, we don't.
> >spddump dumps policies on sptree (ie. only spd ones) while spdflush
> >flushes ones on sptailq (ie. both of spd and pcb ones).
> 
> 	which tree are you looking at?

2.0E.

>	this is on 2.0E and i see number of
> 	stuff like below.  and it is intentional.
> 
> itojun
>  
> 
> # setkey -DP
> (no selector, probably per-socket policy)
> 	out bypass                     
> 	created:                       lastused:
> 	lifetime: 0(s) validtime: 0(s)
> 	spid=16418 seq=0 pid=0
> 	refcnt=3

i haven't seen such outputs.

hm, it seems that you see such entries only when using kernfs,
not via PF_KEY sockets.  right?

YAMAMOTO Takashi