do you have any ipsec policies on the box? I just learned ipsec policies can modify packets even if peers aren't configured / connected. Don't fragment bit can be cleared or set - although I can't make it work, maybe it's part of it. We're not using any ipsec on any of our boxes, but if we could us...