What's upstream from the box that's receiving the mystery traffic? There are are several ways to monitor the traffic before it gets to your box. 1) if the upstream box is a managed switch you can "mirror" the traffic to a spare port, 2) if you have an old ethernet hub (not a switch), you can put between the upstream box and the box getting the mystery traffic. 3) you can build an ethernet tap. <a href="http://enigmacurry.com/category/electronics/">http://enigmacurry.com/category/electronics/</a> 4) if you have a spare box you can stick two ethernet cards into, you can manually configure a bridge using command line tools, or just install one of many linux based router distributions. 5) There may be other options depending on what the current upstream box is. Once you have a hardware configuration that supports capturing all the traffic, before it gets to the firewall filters that drops the traffic before you see it, then you can use wireshark to analyze the traffic, or, if the box capturing the traffic is not running X, you can use tcpdump to capture a binary file first, then ftp it to a box with x and a wireshark. -- Drew Einhorn