Just tried an interesting experiment here tonight. I installed Kerio 2.1.5 and CHX-I, so that both are running concurrently. They appear to coexist nicely, without any visible problems. Kerio seems to catch all the incoming and outgoing traffic, rather than CHX-I. I see all the usual stuff in the Kerio logs, and nothing in the CHX-I logs, with one interesting exception. Now, when an occasional fragmented packet gets thru Kerio, it's caught by CHX-I and logged. So there's no more of that outbound ICMP type 3 anymore to random addresses (the response to the incoming UDP fragments that get thru Kerio). CHX-I catches whatever gets by Kerio. For anyone who was bothered or worried about Kerio's fragmented packet thing, this would appear to be the solution.. My original idea was to try to run CHX-I and add Kerio for outbound app control. However, rather than CHX-I catching inbound traffic, Kerio seems to get it first, so CHX-I is pretty much defeated there. But as a backup for Kerio, it works well.