Hi, > Is there a reason why policy is done > over SA? The SA/state has no last use time on Linux. > I was wondering if there is any harm in changing the call to > query for SA usage, which seems to return bytes and pkts received. Other than the overhead, I guess not. Regards, Tobias