I'm seeing fairly random broadcasts coming from what appears to be my cisco 675. always with a src & dst port of UDP 2066. a quick look around the net, and this looks to be a DLSw port number. so, did cisco put DLSw code into these little buggers, or is somebody firing a spoofed ip at my dsl modem that is acutally getting routed. If this is a hack, it looks to be going after routers/switches, try to find NetBios or SNA paths being tunneled though tcpip. Any thoughts? -- LINUX, because rebooting is for adding hardware! www.linuxsnob.com <-- a little linux humor, and a very little support.