> Maybe I don't very well understand these logs but it clearly shows that bob
> and sam were connected on the same modem for a few seconds...
> Is that what these logs means? If yes, then I have a big problem with my
> logs because I detec about 400 of these each day.
You are not parsing the Acct-Delay-Time, which is a bad thing.
Cristian Gafton
-- -------------------------------------------------------------------- Cristian Gafton gafton@sorosis.ro Computers & Communications Center Network Administrator http://www.sorosis.ro/~gafton Iasi, Romania ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ UNIX is user friendly. It's just selective about who its friends are.