Routing Domains ensure that packets are unable to leave a domain ICMP, IGMP and even TCP create responses interface needed to pass traffic between domains tuned loopback interface userland needs to be able to bind sockets in specific domain setsockopt() per process and inherit on fork() many things still a bit unclear pf extension necessary? interaction with multiple routing tables? performance impact?