Here's a link to the sniffer I mentioned at last night's meeting. A very nasty program that's making its way into a number of the script kiddie rootkits floating about. http://ettercap.sf.net/