You said you can "playback" the intrusion. What exactly do you mean by that? Do you setup a test network and resend the packets and data, or are you just viewing the packets from the log? I'm wondering about the ability to do a full-scale recreation, say for a demo in a court or at a customer site or something. Brian Kelsay