> > Anyone know how to monitor failed telnet connections? > > And by this I mean refused telnet connections from the server end. Hmmmmmm. Solaris keeps connection refused messages in /var/wrapper.log and connection messages in lastlog. The command "last -20" will show the last 20 login attempts. Any that last 0:00 mean they failed to connect. Ezra Freelove Home: http://www.valdosta.edu/~esfreelo/ Blog: http://sneezypb.pitas.com/