one quesition: how does it behave against tunnelled packet?

>The (not yet fully implemetned) ZPC packet logging facility uses a
>format that can be read with tcpdump(8) (the reason it's not fully
>implemented yet is because I need to extend the pcap save file format
>just a bit, and need to get in touch with the tcpdump.org folks about
>this).

	I have done this with racoon, by attachking fake ethernet (or af
	number like loopback) header :-)

itojun