Hi, thx for the quick reply. Paul said ,the tunneled packet being zeroed, this is not the case the original packet retains its tos from point a to b going throught the tunnel. [ip orig]tos 0xb8 --> encrypt [ip esp af11] a>------------->b [ip esp af11] decrypt [ip orig] tos 0xb8 jason