I always gets this message when there is an intrusion, event log as follow, any clue? Event Type: Error Event Source: Microsoft Web Proxy Event Category: None Event ID: 14120 Date: 2003-9-5 Time: 15:46:39 User: N/A Computer: W2AS-INTISA01 Description: The ISA Server services cannot create a packet filter 61.132.102.23. This event occurs when there is a conflict between the Local Address Table (LAT) configuration and the Windows 2000 routing table. Check the routing table and the LAT to find the source of the conflict. Data: 0000: 41 01 00 c0 A..À best regards, lwloo 2k'3