rkeller at ...7000... writes: > Yes, it does. And, when in binary mode, a new log file is created within the log > directory. Please do a snort -W to list the interfaces. You may be running into the libpcap buffer overrun. In that case, you'll need a newer winpcap. -- Chris Green <cmg at ...1935...> A watched process never cores.