>> routing scket operation case was fixed by using sysctl(NET_RT_DUMP). > why can't PF_KEY use a sysctl then? that's one of the possibility, yes. i might do that. please do. a solution that works in all cases without requring /kern to be mounted is highly desirable. .mrg.