On Wed, Jan 07, 2009 at 10:49:55PM +0900, Speedster wrote:

Done. I also realised my wireshark display filter was dst_host rather  
than simply host - it looks as though replies _do_ come back but for  
some reason are ignored? My apologies.

Great I think we're getting closer.  With your latest dumps it'd
appear that there is an odd difference between the replies that
get through and the ones that don't.  The ones that're somehow
dropped have 2 bytes of transport padding at the end.  I suspect
there's something buggy in your system that's dropping it because
of this.

Can you please take a look at /proc/net/snmp on the host and the
guest to see if IP InDiscards is non-zero?

Also now that we know the problem is definitely in the host/guest
please take another set of dumps on the interfaces leading to and
within the guest to see exactly which path of the system is dropping
the reply.

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt