Well..that did work. Could you elaborate a little on what that did to make incoming data plain text at the NIC?

Also...in the Search Monitor,...is the "routed from" ip address the actual host conducting the seacrh, or just the last hop it took? I dont see any additional IP addresses in the data.