Hi John, If you just turn it on and save the capture file (.cap) file and send it to me, I'll take a look. HTH, Tom Thomas W Shinder www.isaserver.org/shinder ISA 2004 Beta - Get it now! http://www.microsoft.com/isaserver/beta/default.asp ISA Server and Beyond: http://tinyurl.com/1jq1 Configuring ISA Server: http://tinyurl.com/1llp -----Original Message----- From: jlyon [mailto:jlyon@xxxxxxxxxxxxx] Sent: Tuesday, March 30, 2004 10:49 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: DNS issue http://www.ISAserver.org Thanks Shivi !!! Tom, I ran this on the DNS server with the All PROTOCOL rule on and then ran it with it off. This is isn't a very busy server, so it isn't like I am missing it, but there appears to be only one connection change which is TCP 3389 taking place if the DNS query is successful???? I will also add that there are two public DNS servers sitting behind the ISA and both have same problem without the ALL PROTOCOLS rule open for them. One DNS server is on 2k and one on 2k3...just more info. Sorry, I am not very sharp on sniffing. -John ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')