diff --git a/ipaudit/ipaudit.spec b/ipaudit/ipaudit.spec
new file mode 100644
index 0000000000..8e7b785554
--- /dev/null
+++ b/ipaudit/ipaudit.spec
@@ -0,0 +1,100 @@
+##
+##  ipaudit.spec -- OpenPKG RPM Specification
+##  Copyright (c) 2000-2002 Cable & Wireless Deutschland GmbH
+##  Copyright (c) 2000-2002 The OpenPKG Project <http://www.openpkg.org/>
+##  Copyright (c) 2000-2002 Ralf S. Engelschall <rse@engelschall.com>
+##
+##  Permission to use, copy, modify, and distribute this software for
+##  any purpose with or without fee is hereby granted, provided that
+##  the above copyright notice and this permission notice appear in all
+##  copies.
+##
+##  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
+##  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+##  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+##  IN NO EVENT SHALL THE AUTHORS AND COPYRIGHT HOLDERS AND THEIR
+##  CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+##  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+##  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+##  USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+##  ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+##  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+##  OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+##  SUCH DAMAGE. 
+##  
+
+#   package information
+Name:         ipaudit
+Summary:      Network activity monitor
+URL:          http://ipaudit.sourceforge.net/
+Vendor:       Jonathan Rifkin
+Packager:     The OpenPKG Project
+Distribution: OpenPKG [BRK]
+Group:        Net
+License:      GPL
+Version:      0.95
+Release:      20020424
+
+#   list of sources
+Source0:      http://ipaudit.sourceforge.net/download/ipaudit-%{version}.tgz
+
+#   build information
+Prefix:       %{l_prefix}
+BuildRoot:    %{l_buildroot}
+BuildPreReq:  OpenPKG, openpkg >= 20020206, libpcap
+PreReq:       OpenPKG, openpkg >= 20020206
+AutoReq:      no
+AutoReqProv:  no
+
+%description
+    IPaudit listens to a network device in promiscuous mode, and records of
+    every 'connection', each conversation between two ip addresses. A unique
+    connection is determined by the ip addresses of the two machines, the
+    protocol used between them and the port numbers (if they are communicating
+    via UDP or TCP).
+
+    It uses a hash table to keep track of the number of bytes and packets in
+    both directions. When IPaudit receives a signal SIGTERM (kill) or SIGINT
+    (kill -2, usually the same as a Control-C), it stops collecting data and
+    writes the tabulated results.
+ 
+    IPaudit is built using the pcap packet capture library to read the network
+    port from LBNL Network Research Group.
+
+%prep
+    %setup -q 
+
+%build
+    %{l_shtool} subst \
+        -e 's;^\(MAKE=\).*$;\1%{l_make};' \
+        -e 's;^\(CIDIR=\).*$;\1-I%{l_prefix}/include;' \
+        Makefile
+    %{l_shtool} subst \
+        -e 's;^\(CIDIR=\).*$;\1-I%{l_prefix}/include;' \
+        src/Makefile
+    %{l_make} %{l_mflags -O}
+
+%install
+    rm -rf $RPM_BUILD_ROOT
+    %{l_shtool} mkdir -f -p -m 755 $RPM_BUILD_ROOT%{l_prefix}/bin
+    %{l_shtool} mkdir -f -p -m 755 $RPM_BUILD_ROOT%{l_prefix}/man/man1
+    (   cd src
+        for i in ipaudit ipstrings total; do
+            %{l_shtool} install -c -m 755 \
+                $i $RPM_BUILD_ROOT%{l_prefix}/bin/
+        done
+    )
+    (   cd man/man1
+        for i in ipaudit ipstrings total; do
+            %{l_shtool} install -c -m 644 \
+                $i.1 $RPM_BUILD_ROOT%{l_prefix}/man/man1/
+        done
+    )
+    strip $RPM_BUILD_ROOT%{l_prefix}/bin/* >/dev/null 2>&1 || true
+    %{l_rpmtool} files -v -ofiles -r$RPM_BUILD_ROOT %{l_files_std}
+
+%files -f files
+
+%clean
+    rm -rf $RPM_BUILD_ROOT
+