one immediate suspect is the lack of machine-specific accellerations for in4_cksum(), which was introduced in the KAME merge. i.e., I think all ports are now using MI code for IP checksums in most cases. This should probably be fixed for 1.5 ... - Bill