"Les Bell" <lesbell at lesbell.com.au> wrote: >> http://sourceforge.net/projects/prodetect/ << Sorry - just remembered that's a Windows program. The classic tool for monitoring IP/Ethernet address pairings is arpwatch, but unlike prodetect, it will only report an ARP cache poisoning attack, not someone silently sniffing (which isn't much use on switched networks anyway). Best, --- Les Bell [http://www.lesbell.com.au] Tel: +61 2 9451 1144