As newoe-18-poc-poc, but now the ping bursts out a few packets so that there are packets during the initial IKE. This test case should show that there are two IPsec SA's started. Since this uses AUTH_NULL, the two cannot be distinguished from different users so they are not allowed to replace each other (unlike in the case of non-AUTH_NULL) icmp -> X IKE_INIT_REQ A -> icmp ----> X <-- icmp reply <- IKE_INIT_REQ B two IPsec SA's establish Note: this test seems vulnerable to a race condition where one connection is already terminated? Note2: Is this premise true? It seems negotiationshunt=passthrough might not work as expected with XFRM/NETKEY? That is what this test now shows.