Probably not. This is very common when DNS query responses are "late", as far as ISA is concerned. Since ISA has "timed out" the DNS query, the response is seen as a port scan. Generally, you can ignore this, but if it happens consistently, you may want to consider using different external DNS servers. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/pages/author_index.asp?aut=3 http://isatools.org Read the help / books / articles! ----- Original Message ----- From: "Farshad Farooji" <farshad@xxxxxxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Tuesday, January 07, 2003 08:29 Subject: [isalist] DNS qureries cause ISA alerts http://www.ISAserver.org Hi everyone; I posted this message yesterday, unfortuantely got no answers. since it is getting to be a serious problem for me I am doing it again. I have been receiving ISA alerts as all port scans and so on very frequently and it is very anoying. now I have found out that these alerts are caused by DNS queries thru ISA. my clients are mainly webproxy and securenat. is there anything wrong with my settings on the ISA? thanks for the help, Farshad ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Exchange Server Resource Site: http://www.msexchange.org/ Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')