On Friday 14 May 2004 21:11, azeem ahmad wrote: > thanks a lot for solving this problem > but here just tell me one thing more that how u said that i m safe. is > there tcpdump output telling something. if yes then how u judge it. I'm repeating myself here :) It's obvious because only one direction is logged. Try doing 'tcpdump -n port 80' for example, and you will see both sides of the TCP conversation, and compare that with the 'port 25'. Cheers, Gavin