Random observations, some more obvious than others :) *) in the face of packet losses, the TCP congestion window may not get and/or stay as large as the classic TCP window. so, check netstat statistics *) if you cannot get the perf level with say a netperf TCP_STREAM test :) it ain't gonna happen with crypto. rick jones