About traceroute... I think traceroute relies on a icmp message "expired in transit" returned by each host on the route with increasing TTL on each probe. I am not shure that encap tunnels are able to provide such behavior. By looking to the traces, the "expired" icmp message is sent to the public tunnel endpoint IP from the machine where the TTL expires, but it is not encapsulated so does not make it to back to the traceroute utility. This could be a linux-only behavior, never tried it on nos derivatives...
Marius.