I'm not sure how to determine whether a given network packet is an FTP packet or not... the ftp-data connection has no strictly specified TCP ports - it can be a normal TCP connection between a random port on your computer and a random port on someone else. (most ftpd's do not use the ftpdata tcp port for anything instead using unpriviledged random high port numbers) ... MaZe.