Hello! Here are two lines of my /var/log/messages: Aug 4 21:16:22 www wu.ftpd[25329]: connect from root@212.160.104.141 Aug 5 02:49:53 www wu.ftpd[25641]: connect from root@212.160.104.141 They seem a little bit strange to me that a root on some box will trying FTP to our server. I tought it might be perhaps and cracker who got root access to another server. (Altough this IP can't be resolved by nslookup, which should indicate that it isn't a server.) But in my /var/log/xferlog, there's no traffic at these times. What does that mean? Bye, Jan BTW: My server identifies as: 220 www.rst-consulting.de FTP server (Version wu-2.4.2-academ[BETA-12](1) Sun +Jan 19 23:05:28 CST 1997) ready. -- +-------------------+--------------------------------------------------------+ | Jan Theofel | rst Unternehmensberatungs- und Handelsgesellschaft mbH | | Webadministrator | Bahnhofstrasse 35, 71272 Renningen | | | Tel.: 07159/800-450 Fax: 07159/800-451 | +-------------------+--------------------------------------------------------+