Hi Arjan, IMHO it makes sense to check traffic by tcpdump: on the host server's external interface and on internal venet interface, and then on venet inside VE. thank you, Vasily Averin