Dan, On page 221 of "The TAO of network security monitoring" by Richard Bejtlich fresh ports is mentioned by name and so are you at the author of said website. marc