>    > 	sysctl -w net.inet.ipsec.debug=blah?
>  Thanks. I wasn't aware of that.
>  But, it would be nice to have a rate limited output that didn't require
>debugging.

	hmm, will think about it.  what other systems do?
	we will need to keep track of unknown SPIs we've seen...

itojun