real quick while I have a moment, you can also use tcpdump -vvn port 53 to see dns queries another option is to strace the sshd and forks, strace -p <pidof-sshd> -vv -e <expression>. I don't recall what expression would be best, connect comes to mind. Good luck. Scott