> I've tried defaulting ntscookies to -1 and testing for > that - change pushed. Thanks. Looks good. That now exposes a subtle detail. If you see NTS in the refid column, look at the t column. If it is "u", then the NTS-KE level didn't work. If you see a "0" there, then the NTS-KE worked but it ran out of cookies. -- These are my opinions. I hate spam.