I wrote up a small analysis of ssh and ssl traffic using tethereal dumps and have put it up on my Web server at: http://www.kristau.net/ssl-ssh_question.txt I posted it to my own Web server so as not to flood the list with the tethereal dumps which will inevitably make it into any replies. thanks, kristau