thanks buddy. did try that out. didn't quite work.. think it's a net::pcap limitation. i'll save that in my bag of tricks though? :)