If you are masquerading I guess the kernel would do it.
> I'd prefer having the process do it, because otherwise it's hard to
> handle to semantics of CONNREFUSED correctly.
Humm.. I guess the masquerade can always reply with stuff like
"550 Host is down"
if its connect fails.
Alan