An Update. When using kernel 2.6.16.29, I don't see the problem. Packets taken with tcpdump/libpcap are the real packets. Linux Merak 2.6.16.29 #1 SMP Fri Oct 27 04:33:56 CEST 2006 x86_64 x86_64 x86_64 GNU/Linux Regards, Carlos Velasco CCNP & CCDP Cisco Certified Network Professional - To unsubscribe from this list: send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html