For what it's worth, the code I wrote for XORP is only for IPFW2, and uses its tables feature to atomically transcribe XORP rulesets to IPFW ones before swapping them in. Regards, BMS