When doing tcpdump -n -e -ttt -i pflog0 I frequently see packets blocked that looks like this 458660 rule 0/0(match): block in on em0: xxx.yyy.zzz.qqq.993 > qqq.zzz.yyy.xxx.59930: tcp 8 [bad hdr length 12 - too short, < 20] It's the IMAP server I'm using that tries to talk back. Is this something I should try to let through? /Leslie