Real, Just find TopN pkts and rate(source) for port. Total bytes can't be really used to observe or detect as you said no application data. -- Best Regards, CS Lee<geekooL[at]gmail.com> -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20070407/11650b33/attachment.html>