thanks, I'll check to see... both routers, and the receiving syslog server, are inside the LAN, no FW between anything. I have a script someone gave me that parses the log and matches MACs to entries for 'assoc' and 'dhcp'... I purely log devices that come on/off the network and when.