Carter, Thanks, at least now I know it is not just the proto field in IP header where I previously thought it is. I will test more about other argus client tools to see how things go. Cheers.