Try websnarf: http://www.unixwiz.net/tools/websnarf-1.04 Set the port to 21 & log some of the data they're sending. You can have it log the session to a file, too, I think. Note that the one line it grabs may not amount to much of anything, but it might give you some idea what the machines are trying to do. - Matt