cdowns wrote: > ngrep -d eth0 -Wia2 'user|pass' -s 1514 -t dst port 110 >> > /home/username/mail.passwords That works pretty nicely. Is there an easy way to get rid of the time stamp and lines between them so that I am left with a file of user/pass's that is easily imported into a spread sheet? Thanks, Brad