This week, we:

• got 11,732 messages from 232 different IP addresses.
• handled 18,216 sessions from 1,165 different IP addresses.
• received 189,951 connections from at least 55,941 different IPaddresses.
• hit a highwater of 7 connections being checked at once.

This is all down from last week , and I haveno explanation for why the messages received count is down so much; itis normally quite

In no particular order:

• point to point GRE tunnels have to be symmetric, where each end is amirror image of the other. Otherwise the destination kernel willreject the inbound GRE packets, which makes sense from a securityperspective once you think about it.

• GRE tunnels require a local IP address before you can point routes atthem; I suspect that this is generic behavior and is so that the kernelknows what default origin IP address to put on packets going out throughthem.
• because GRE tunnels are network devices,

I normally expect IP tunnels to be opaque , that is to act as if theywere physical links: the packet is sent down one end and pops out theother end unchanged, just as if it went over a connection betweentwo routers, and the tunnel itself is indifferent to the details ofthe packets it is transporting. (The technical ISO way of describingthis is that I expect IP tunnels to act entirely as layer 2 entities.)

However, one of the peculiarities of GRE is that itis a translucent