Since no scripts to do what I was looking for have been forthcoming, I broke down and decided to prove to myself I still know perl. Find attached the following: flow-smurf.pl Takes a sorted output (simple unix sort) from "sh ip cache flow" and finds what it believes are smurf amplifiers. The thresholds for number of bytes, number of flows, prefix length, etc are all tunable. Outputs a list of suspect prefixes. smurf-email.pl Takes a list of prefixes, looks them up in whois, and prints a list of contact email addresses and the associated prefixes. Also emails the contacts if you specify a return address. Requires ipw. Stephen ObRandy: "no ip routing" will stop smurf attacks | | Stephen Sprunk, K5SSS, CCIE #3723 :|: :|: NSA, Network Consulting Engineer :|||: :|||: 14875 Landmark Blvd #400; Dallas, TX .:|||||||:..:|||||||:. Pager: 800-365-4578 / 800-901-6078 C I S C O S Y S T E M S Email: ssprunk@cisco.com