I've written a very simple utility that can convert from tcpdump capture format to microsoft network monitor (netmon) format. We are using this to help us get the new NT domain controller code working. Some people may find this useful for other things. It's available at ftp://samba.anu.edu.au/pub/samba/tcpdump-smb/capconvert.c Andrew