Somebody in the thread at some point said: > ps -Af > > if nothing comes to mind... is yum running or some other Friends Of Yum > like pup or the Package Manager applet... "you have updates" warning > applet or something like that? Hm actually try # lsof | grep uci\.edu and it should show which process has a socket open there (if it is still open by now). If not run tcpdump again to catch a new piece of the domain name it is touching and amend the grep accordingly. -Andy
