I'm using cflowd and have some understanded result. I have udp type flow with destport and srcport = 0 (both), src ip address and dest ip adress are set and src ip adress seems to be a streaming server. Does someone can say what exactly this means ? thx Christophe Ponsen Skynet/Belgacom NV/SA Belgium