Have you seen many attempts to spoof the mac address? As long as you get in a log, you can send it to external syslog server and graph it. See my signature for example on monitoring MT using Splunk. Not really, but I am logging all connections for legal purposes. But now have separated the log file...