> FYI, I've sent along a short tcpdump log to Matthew. --- [poptix at techmonkeys poptix]$ grep -v -E "arp|65-25-234-54|ellegon" tcpdump.txt 17:14:21.915343 10.38.208.1.bootps > 255.255.255.255.bootpc: xid:0xb8de17bf flags:0x8000 G:10.38.208.1 ether 0:3:93:53:e8:44 [|bootp] --- I removed arp traffic, and traffic to your address, the DHCP query left over is normal (broadcast traffic). ellegon.com appears to be registered to you, so I removed it from the grep, I'd be happy to look at another log (with the -n (do not resolve) option turned on). -- Matthew S. Hallacy FUBAR, LART, BOFH Certified http://techmonkeys.org/~poptix GPG public key 0x01938203