If you have a unix box you should take a look at arpwatch. That tells us when a machine comes on the network (rebooted or a new box) or if the mac address has changed for a particular ip adress be it merely a new nic you installed or more importantly someone trying to masquerade on your network as a valid machine. -------------------------------------------------------------------------- Michael Brown Cycorp, Incorporated [EMAIL PROTECTED] 3721 Executive Center Dr., ste 100 (512) 514-2978 (phone) Austin, TX 78731-1615 (512) 342-4040 (fax) http://www.cyc.com --------------------------------------------------------------------------
