> What about "post-traffic police" and/or "post-re-checking" without kicking user and machine out by clearing "Certified Device List"?
I hate to be a pig about this, but how about Snort? (Sorry, but pig jokes are mandatory when discussing Snort.) It is purpose built for that function and has a lively support community, and is maintained by people who stay pretty in touch with the latest hacks. It is VERY widely used and I am pretty sure some commercial products use it. I even seem to recall a salesman telling me about a Snort appliance although I am sorry to say I can't recall the name of the product. Dan Sichel Ponderosa Telephone
