In some mail from Dorin H, sie said: > > True, it's part of IDS. Nevertheless, do you think > that traffic normalizing is useful? No. The worst part of normalizing traffic is that it "tampers" with your evidence that comes in from the network. Darren