> the utmp/wtmp
> (which ever one is the login record and not the who's here now file) is
> not recording anything except ip addresses.

Do you get anything if you run
$ printf "set q=ptr\n198.82.200.98\n" | nslookup

(substituting the IP address, as appropriate)  There is a PTR record,
right?  Have you restarted the nameserver that's serving the PTR
records?  Or sent it a SIGHUP after incrementing the serial number on
the record?

-allen

-- 
              Allen Briggs - end killing - briggs@macbsd.com