On 2016-09-11 10:21, Christian Rößner wrote: > p0f -i eth0 -u p0f "not src net x.x.x.x/x and port 25" 2>&1 | > p0f-analyzer.pl 50000 & is your pcap filtering here cut ipv6 ? make it dual stacking not filtering on specifik ips, just port 25 if its not that i dont know why