> I use tcsh (6.04, now 6.05), and I've noticed that it hits the network 
> whenever I 'su' to root.

Uh ... is "tcsh" your login shell for "root"?   Sure hope it's in "/" ...
(as in, the root partition)

> I had originally thought this to be something to worry about from a security
> standpoint, but I can't imagine what it's sending through the network

"man tcpdump"

> My system is an untainted build of 1.1, so I'm sure it's just some 
> config bit somewhere or an attribute of login shells I've overlooked.
> Why should a login on my local machine have to hit the pppd interface?

As our Slovenian correspondant alluded to, I suspect the shell is trying to
set $REMOTEHOST.  First I'd make sure you're running 6.06 instead of 6.05,
then do a "set | grep version".  See if you see "rh" in the "options" string.
If so, then let "tcpdump" tell you what is going out the PPP link.  I
suspect you'll probably find that it's a DNS lookup of some sort ...

	- Greg