>> If the user in question is using MacOS X, it ships with tcpdump. > >Hrm, I thought this wasn't the case. Did this change with 10.4? I remember using it under 10.3, definately. AFAIK, it's always been there, since it was a standard part of the BSD userland. I guess you could miss if your path didn't include /usr/sbin. --Ken