That *is* the payload.
could you please post some *payload* of these packets instead of just the tcpdump one-liner? Perhaps that's why we confused about your tcpdump output/usage.
Paul Schmehl (pauls@xxxxxxxxxxxx) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html