I read an article about using iptraf on an interface without an IP address, just in promiscious mode. Anyone know if Snort will work this way. http://www.zdnet.com/enterprise/stories/main/0,10228,2675100,00.html -- Bob Tanner <tanner at real-time.com> | Phone : (952)943-8700 http://www.mn-linux.org | Fax : (952)943-8500 Key fingerprint = 6C E9 51 4F D5 3E 4C 66 62 A9 10 E5 35 85 39 D9