syncdet lists /24's with greater than a specific threshold of connections on your server. The original site no longer exists. syncdet-orig.c is the original distribution. syncdet-hwy.c includes an extra flag to netstat on FreeBSD to prevent it from coring when it tries to parse IPv6 hosts. This is often useful as a regular cron job (which can establish a baseline for what types of clients your server typically holds) An example crontab entry is: 9 */6 * * * /home/wcampbel/bin/syncdet 3 To run every 6 hours, showing me blocks with more than 3 connections. http://www.darkbot.org/mambo/index.php?option=displaypage&Itemid=68&op=page&SubMenu=