cant help directly, but grab Ethereal (.org) and run it on a workstation - its able to break down the ICMP packets and tell you what theyre actually asking/doing. Dont know for certain, but i'd probably suspect that the workstations are just checking they still have access to the DC Andrew --o-- >>> JLuchette@xxxxxxxxxxxxxxx 19/07/04 18:46:25 >>> We have recently set up an IDS (Intrusion Detection) system on our network and are seeing a large amount of ICMP traffic (pings) traveling from all client workstations to our two Domain Controllers, that are also running DNS. We are a mixed mode domain. I was just wondering if anybody knew if it is normal for a client workstation to contact a domain controller at regular intervals via ping/ICMP or not? Why does this happen/is this something that I should worry about? ******************************************************** This weeks sponsor Emergent Online Thinssentials Utilities Using the latest software, hardware, networking technologies, proven technical expertise, proprietary software and best practices, EOL provides custom-tailored solutions for each client?s mission and specific goals. http://www.go-eol.com ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm