I have been playing with netstat, trying to see if it can detect something unusual when a process is listening promiscously. There is nothing I could see. However, when you use ifconfig, you WILL see the PROMISC flag: crow% ifconfig le0 le0: flags=163<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC> inet 192.26.58.254 netmask ffffff00 broadcast 192.26.58.0 crow% [] So there is a way to see if someone (at least on Suns where the attacks have been occurring) has a listening daemon set up. rik@uworld.com