The example in the manpage is incorrect: rasort -r inputfile -M daddr dport saddr - ip ^^^^ should be '-m' Wolfgang -- <wob (at) swobspace de> * http://www.swobspace.de