If you can run a monitoring/span port on the inside network that will see all traffic then NTOP on a *nix host can give you netflow. -- James H. Edwards Routing and Security Administrator At the Santa Fe Office: Internet at Cyber Mesa jamesh at cybermesa.com noc at cybermesa.com (505) 795-7101