Doesn't binding the interface to a private IP range protect against just this? Please do tell me if I've got this wrong... Patrick