HAWKER, Dan wrote: ># Class to match vmware MAC addresses >class "vmware" { > match if substring (hardware,1 ,5) = 00:0c:29; > } Have you tried substring (hardware,1 ,3) ? 5 bytes is never going to match 3 bytes ! You also start at byte 1 (the second byte) and byte 0 is the hardware type. Simon