> ecn is not being negotiated on tcp connections to SA(??), That's unfortunately pretty common. A common practice is to clear any priority information in packets coming into your network; unfortunately, a lot of routers clear the whole DSCP byte, including the ECN bits. -- Juliusz