http://luca.ntop.org/Ring.pdf gives some interesting insights into packet capture architectures. I knew that stock systems didn't do very well; I'm astonished at how poorly they do at monitoring a network. --Steve Bellovin, http://www.research.att.com/~smb