this may sound really too basic, but it strikes me that you're quite
possibly seeing a flow decode bug shifting some fields and giving you bad
data. ("think horses, not zebras" and occam's razor ...)are you sure the flow coming out of that device is formed as your flow decode tools expect it to be? feel free to contact me off-list, i work for a ocmpany that does boatloads of flow processing and may be able to help you out, as well. ________ jose nazario, ph.d. [EMAIL PROTECTED] http://monkey.org/~jose/ http://infosecdaily.net/ http://www.wormblog.com/
