Having upgraded from 5.4 to 6.1-PRERELEASE on two systems I find that ipmon produces an output on one but not the other. "truss ipmon" on the non- functioning system produces . . . open("/var/run/ipmon.pid",0x601,0644) = 4 (0x4) getdtablesize() = 11095 (0x2b57) fcntl(4,F_GETFL,0x0) = 1 (0x1) getpid() = 88512 (0x159c0) fstat(4,0xbfbfc900) = 0 (0x0) write(4,0x805f000,5) = 5 (0x5) close(4) = 0 (0x0) sigaction(SIGHUP,{ 0x8049510 0x0|ONSTACK|RESETHAND|NOCLDSTOP|NODEFER|NOCLDWAIT|SIGINFO ss_t },{ SIG_DFL 0x0|ONSTACK|RESTART|RESETHAND|NOCLDSTOP|NODEFER|NOCLDWAIT|SIGINFO ss_t }) = 0 (0x0) ioctl(3,FIONREAD,0xbfbfccfc) = 0 (0x0) nanosleep({1 0}) = 0 (0x0) ioctl(3,FIONREAD,0xbfbfccfc) = 0 (0x0) leading to endless iterations of nanosleep, whereas the system w/ the working ipmon begins to write packet pass/block values @ this point. there are no relevant kernel differences (ipfilter, ipfilter log, & ipfilter default block are compiled into both). both run 6.1-PRERELEASE on i386, loader.conf sysctl.conf are the same on both systems, rc.conf is the same in all relevent respects w/ the possible exception that the system w/the non- working ipmon is natting, & both system have the same modules installed. i'd appreciate suggestions for troubleshooting this problem. thanks. ==========David Coder Erstwhile Network Engineer Washington, DC