On Tuesday 08 December 2009 11:21:14 pm Data Lineage wrote: It records what is passed to the connect syscall or what accept is seeing. That is probably correct. I don't recall seeing duplicate network records I'm pretty sure it could be patched to provide that if its not. I think we might want a new record type or some way of distinguishing which record is local and remote. I have been reading through the new OSPP from NIAP and it calls out for selective audit based on network address, too. So, it would kind of fit with what will be required going forward. So...were you planning to send a patch or is this a request for us to write one? -Steve