> As others pointed out (to me as well), for a _man in the middle_ attack > (e.g. impersonating www.paypal.com) it is necessary to play ARP games or > otherwise insert yourself in the flow of traffic. not really. you just need to be there first with a bogus, redirecting, dns response. randy