I *think* ptrace gets hit before the filter - so the packets will show.
The best way to test a filter is 'log' on the filter rule and then see
if the packets are triggering logging - that means the rule is hit.
-MZ
-- Livingston Enterprises - Chair, Department of Interstitial Affairs Phone: 800-458-9966 510-426-0770 FAX: 510-426-8951 megazone@livingston.com For support requests: support@livingston.com <http://www.livingston.com/> Snail mail: 4464 Willow Road, Pleasanton, CA 94588