Hmm - the boot request is actually far below TCP/IP in the protocol scheme, so it's not surprising that at least some versions of tcpdump don't see it. Does the tcpdump that you're running have a promiscuous mode (usually '-p')? Most boot servers can be set in a mode where they print out the hardware address of anything that makes a request. From VMS, you can just log in, do a REPLY/ENABLE, and you'll see the hardware address whenever anything on the net requests a boot. If you have a DEC machine that has an ability to show its hardware address (e.g. just about anything except a uVax II), you can pull the bipolar PROM on the DEQNA and drop it into the "more capable" machine and show the address burnt into the PROM. AFAIK all the DEC hardware address PROM's are interchangable. Alternatively, just boot VMS on the uVax, get into NCP, and do a SHOW CHAR LINE * to show the hardware addresses of all the configured ports: $ mcr ncp NCP>show char line * Known Line Volatile Characteristics as of 9-MAR-1999 17:37:22 Line = SVA-0 Receive buffers = 10 Controller = normal Protocol = Ethernet Service timer = 4000 Hardware address = 08-00-2B-39-7B-64 Device buffer size = 1498 -- Tim Shoppa Email: shoppa(a)trailing-edge.com Trailing Edge Technology WWW: http://www.trailing-edge.com/ 7328 Bradley Blvd Voice: 301-767-5917 Bethesda, MD, USA 20817 Fax: 301-767-5927