I wonder whether this is an artifact of ipv4 packets to/from an ipv6 interface, where v4 addresses map to v6 addresses in ::ffff:/96 and therefore have the form « ::ffff:a.b.c.d ». Just speculating, -JimC -- James Cloos <cloos at jhcloos.com> OpenPGP: 1024D/ED7DAEA6