I'd like to hear from the list as to what your preferred means of determining what the hell is going on at a packet level at the other side of a WAN/MAN/frame/etc link. It seems to me that the means available are A) a very expensive distributed NAI Sniffer installation B) standard RMON probes and the NMS of your choice and C) A linux box with a ton of interfaces running Ethereal accessed via Xwindows/VNC/whatever. Personally, I'm inclined to explore option C. The bells & whistles of a commercial package like NAI's Distributed Sniffer are not really a compelling value added to me. It's a shame there's no Open Source RMON agent available. I'm asking NANOG because I figure this is something pretty much every network engineer bumps into at one time or another. thanks, -carl