["Erick B." <erickbe@xxxxxxxxx>]

> The problem is that an SNMP *request* might be
> transmitted to port 161,
> but there is no guarantee that the request comes
> from that port, and
> thus no guarantee that SNMP *replies* are sent to
> that port - they're
> not even necessarily sent *from* that port?

Okay. Thats fine and acceptable. How about matching on
the multicast address and/or port # for HSRP if
possible? I'm not really familiar with the source in
detail so I'm not 100% positive what data is available
to match on for the dissection process. I wish I had
the compiliers to compile the win32 version, but will
have to put together a linux system so I can work on
some ideas I have. 

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com