Found the following after discussing the Snooper model for predicting "a run on this port was made on $Date" and I suspect it MAY, possibly, be worth considering for alert thingbobs in NOCtool: http://www.usenix.org/events/lisa2000/full_papers/brutlag/brutlag_html/index.html //Ingvar