I would like to make clear a bit of info... The discussion I started about attacker bandwidth multiplication and HTTP GET attacks was based on theoretical concerns and other possibilities which, as information is coming out now, appear to be unrelated to the actual current attacks. I had been thinking that it might be that type based on some comments by a Yahoo staffer, but was told late today that he'd been slightly misquoted and that all the current attacks are variants of ping flood, syn flood, etc. (known TFN-2K code being used, apparently, or so sez Cnet). -george william herbert gherbert@crl.com