Hello Tony
Another variant is to change in the file viewhits the option ipsort to ------------------------- ipsort) HEAD='<tr><td width="50"> Hits </td><td>IP-Adress</td><td> </td></tr>' AUS="`grep "DPT=$content " /var/log/messages |\ sed 's/.*SRC=\(.* \)DST.*$/<a href=viewhits?x_\1>\1<\/a><\/td><td><\/td><\/tr>/'| sort -n | uniq -c |sort -rn|\ sed 's/^/<tr><td>/ s/<a/<\/td><td><a/`" ;; --------------------------- this is a little bit slower but let you click on each ip address that tried to connect to the certain port and shows the messages that it caused, including those to another port Regards Eric Wolzak member of the bering crew ------------------------------------------------------- This SF.net email is sponsored by: eBay Get office equipment for less on eBay! http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
