  <varlistentry>
  <term><emphasis remap='B'>priority</emphasis></term>
  <listitem>
<para>The priority in the kernel SPD/SAD database, when matching up packets.
Each kernel (NETKEY, KLIPS, OSX, etc) has its own mechanism for setting the
priority. Setting this option to non-zero passes the priority to the kernel stack
unmodified. The maximum value depends on the stack. It is recommended not to exceed
65536</para>
<para>
KLIPS and NETKEY use a priority system based on "most specific match
first". It uses an internal algorithm to calculate these based on network prefix length,
protocol and port selectors. A lower value means a higher priority.
</para>
<para>
Typical values are about the 2000 range. These can be seen on the NETKEY stack using
<emphasis remap='B'>ip xfrm policy</emphasis> when the connection is up. For "anonymous IPsec" or Opoprtunistic Encryption based connections, a much lower priority (65535) is used to ensure administrator configured IPsec always takes precedence over opportunistic IPsec. 
</para>
  </listitem>
  </varlistentry>
