and now, performance!


start with low-hanging fruit
I need to give you something before we get muddy and I have to explain a lot again

one: skip recursing into ipsec layer if the system doesn't use ipsec
very easy to implement, maybe 10 lines of code
gives some 5% or so