hello again, Finally found a solution. Just have to start Snort with: snort -A fast -c /etc/snort/snort.conf -i ppp0 -b and it works. I am also using a "Snort Gui". For those who are intrested: http://www.intersectalliance.com/projects/RazorBack/ it completely fulfills my needs. pedro