tcleary2 at csc.com.au wrote: > For instance, if you run snort without a config. file defined, it just > runs as a sniffer. Except MRTG, which simply uses packet and traffic counters maintained by the kernel and exported by snmpd (or exposed over snmp from whatever device you're monitoring). -- Craig Ringer