The only way you'll know is to get a simultaneous capture at both ends of the ISA. Since the ISA logs also tell you what the URL was, you have a starting point to work from. NetMon 3 can get a multi-network capture in a single application instance. 1. Go to http://connect.microsoft.com <https://mail.microsoft.com/OWA/redir.aspx?URL=http%3a%2f%2fconnect.micr osoft.com> 2. Sign in with your passport account 3. Choose "Available Connections" on the left 4. Choose "Apply" for Network Monitor 3.0 (once you've finished with the application, the selection appears in your "My Participation" page) 5. Go to the Downloads page (On the left side), and select the appropriate build 32 or 64 bit build. Please use the Connects site Feedback option for bugs and feature requests Please use the Connects site Newsgroups for and support. From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Ball, Dan Sent: Tuesday, October 03, 2006 7:50 PM To: isalist@xxxxxxxxxxxxx Subject: [isalist] Unsupported Header I have someone asking for help, they are getting the following message from the ISA server: 12156 The HTTP message includes an unsupported header or an unsupported combination of headers. I haven't been able to find this in the help menus or via searches, what would cause it? Sorry, I don't have very many details about the system... All mail to and from this domain is GFI-scanned.