I dont know what ip xfrm means - excuse my ignorance please
I will try it 

-----Original Message-----
From: David Miller [mailto:davem@davemloft.net] 
Sent: Tuesday, January 27, 2009 9:21 AM
To: Paul Moore
Cc: kaber@trash.net; netdev@vger.kernel.org
Subject: Re: port bound SAs

From: "Paul Moore" <redacted>
Date: Tue, 27 Jan 2009 09:13:46 -0800

the pfkey / xfrm interface throws them away

i fixed racoon to send the port numbers and they were ignored

Did you actually try "ip xfrm" as Patrick suggested?

Where exactly are the ports "thrown away" for both pfkey and xfrm
cases?