When using the names option of flow-report, where does it get the service port-name mapping information? I don't think its from /etc/services - we're using tcp port 1535 for SQL, and the names option is labeling it as micromuse-lm. I don't have micromuse in my services file at all. Where would I edit this? Thanks much to all, happy holidays!