Actually, you can ignore the "-s1600" request, looks as if someone has finally made tcpdumps default snap length somewhat bigger... It won't hurt if you have done it using that option, but it also should no longer (I have no idea for how long back into the past) be needed. kre