site_archiver@lists.apple.com Delivered-To: Darwin-kernel@lists.apple.com

And the audit record's remote host's port number of 21984, doesn't appear to be anything like I was seeing via tcpdump (a port of 57429).

OK, the reported port number 21984 is just a byte swapped 57429, so this is just a bug that needs to be reported. I'm still looking for the address family issue. Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com