Dave & Dennis, thanks a lot for your valuable insights. And of course, apologies for making the cisco guys look like they didn't read the RFC. Thank God this was written as a question with a smiley... # Dennis Ferguson # > I can tell you for sure that the Cisco routers do send the packets (GRE # > or IP protocol 4) with a length which includes the IP header, just like # > the RFC. If you look I think you'll find that it is your kernel which is # > subtracting out the IP header length before it hands the packet to you on # > the raw socket. # # BSD Unix converts the length to host order and subtracts the IP header # length. Ugh! The platform in question is Solaris 2.5.1. So we have one more datapoint. I'd consider this a bug unless it's documented somewhere outside of the kernel sources. What do you think? Should I harass the Solaris developers? # Linux leaves the length in net order (don't know about subtracting). # Windows leaves the length in net order and does not subtract the IP # header length. # # -Dave Regards, -- Jens Schweikhardt http://www.shuttle.de/schweikh/ SIGSIG -- signature too long (core dumped)