Most people use ethereal for pretty gui packet dissection. It's under the GPL, so it's FSF flavored Free. ethereal can read your tcpdump capture, or can do the capture itself. If you capture with tcpdump, I'd recommend doing the capture with -s 0 to get a full recording of the traffic. OK, so I've built ethereal (that took awhile!) from source, and it now runs (nicely!) under X11, as expected. My next comment it ... arrrrgh! Short of RTFM'ing (which I'm doing ...), what the %&^% am I looking for? Should I simply capture tcpdump output on both "ends" of the suspect SSH transaction, and import them into ethereal? richard _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.