check for mark changes in ipsec update