[bbjnicklin]

Feld, you are totally right. In fact, there has been discussion in the Linux community about improving IPsec performance. However, as the post states, the difficulty in doing so is the API contract in the kernel. That said, even with a perfectly optimized IPsec stack, having to process each packet individually will always be slower than processing a logical record that is a multiple of packet size.