Will something like: $IPTABLES -A INPUT -p tcp --tcp-flags RST -m state --state NEW -j LOG Log "RST injection" packets potentially explointing that mentioned in US-CERT TA04-111A? If not, any ideas? Thanks for the feedback. Earl __________________________________ Do you Yahoo!? Yahoo! Photos: High-quality 4x6 digital prints for 25¢ http://photos.yahoo.com/ph/print_splash