Derek Loree said: > I think it would be more a matter of timing, if I saw lots of ssh > traffic coming from a workstation with no driver, I would be suspicious. Maybe if the destination port is port 80 then it would be less suspicious, like some nightly software update to up2date or windowsupdate, etc.