In 3.1(12) we used "no sysopt connection tcp sack-permitted" to deal with the FWSM's lack of TCP SACK option support. Somewhere betweeen (12) and 3.1(16), that command disappeared. Did the syntax change?