Also, this seems like a good time to mention a couple of additionl resources on trending specific TCP and UDP port probes (if you haven't already seen them): http://www.dshield.org/ http://www.mynetwatchman.com/ - ferg -- sjk <sjk@cupacoffee.net> wrote: We are an ISP - we look for specific trending data to help pinpoint new potential virus and malware which can adversley effect transit links or equiptment. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg@netzero.net or fergdawg@sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/