Could some kind sole explain what this means? Do I need to add a protocol rule? adsl-67-127-120-169.dsl.sktn01.pacbell.net 12/17/2003, 8:19:33, 67.127.120.169, <My IP>, ICMP, 3, 3, -, BLOCKED, ... It is from the Packet Filter log. Servers running behind ISA are web, email, nntp, ftp, & dns. Also, after using my log scanner for a bit, I deemed it not all that useful. I have updated it and hope some find it useful: http://nikola.com/freebies.htm Regards, - Robert