Hi, whether you use the DHCP or DNS method to locate the wpad entry, in both cases a full auto-detect in Internet Explorer (IE) and the Firewall client (FWC) may take up to 13 seconds! I see that behaviour in Windows 2000 up to and including SP4 with all critical updates, and also in Windows XP up to and including SP2 with all critical updates. The problem can be reproduced easely. 1. IE DHCP method: ------------------ DHCP ACK contains http://isa.intranet.splab.net:80/wpad.dat as option code 252. No. Time Source Destination Protocol Info 1 0.000000 192.168.22.100 255.255.255.255 DHCP DHCP Inform - Transaction ID 0xfe7e973d 2 0.002204 192.168.22.2 192.168.22.100 DHCP DHCP ACK - Transaction ID 0xfe7e973d 3 4.027730 192.168.22.100 255.255.255.255 DHCP DHCP Inform - Transaction ID 0xfe7e973d 4 4.037363 192.168.22.2 192.168.22.100 DHCP DHCP ACK - Transaction ID 0xfe7e973d 5 13.216448 192.168.22.100 192.168.22.2 DNS Standard query A isa.intranet.splab.net 6 13.221231 192.168.22.2 192.168.22.100 DNS Standard query response A 192.168.22.1 7 13.224327 192.168.22.100 192.168.22.1 TCP 1303 > http [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 8 13.231428 192.168.22.1 192.168.22.100 TCP http > 1303 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 9 13.231452 192.168.22.100 192.168.22.1 TCP 1303 > http [ACK] Seq=1 Ack=1 Win=65535 Len=0 10 13.231654 192.168.22.100 192.168.22.1 HTTP GET /wpad.dat HTTP/1.1 11 13.234891 192.168.22.1 192.168.22.100 HTTP HTTP/1.1 200 OK (application/x-ns-proxy-autoconfig) 12 13.234912 192.168.22.1 192.168.22.100 HTTP Continuation or non-HTTP traffic 13 13.234933 192.168.22.100 192.168.22.1 TCP 1303 > http [ACK] Seq=125 Ack=2921 Win=65535 Len=0 14 13.241378 192.168.22.1 192.168.22.100 HTTP Continuation or non-HTTP traffic 15 13.361555 192.168.22.100 192.168.22.1 TCP 1303 > http [ACK] Seq=125 Ack=2936 Win=65520 Len=0 16 13.371409 192.168.22.1 192.168.22.100 TCP http > 1303 [FIN, ACK] Seq=2936 Ack=125 Win=65411 Len=0 17 13.371512 192.168.22.100 192.168.22.1 TCP 1303 > http [ACK] Seq=125 Ack=2937 Win=65520 Len=0 18 13.371728 192.168.22.100 192.168.22.1 TCP 1303 > http [FIN, ACK] Seq=125 Ack=2937 Win=65520 Len=0 19 13.374219 192.168.22.1 192.168.22.100 TCP http > 1303 [ACK] Seq=2937 Ack=126 Win=65411 Len=0 20 13.382720 192.168.22.100 192.168.22.1 TCP 1304 > 8080 [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 21 13.391508 192.168.22.1 192.168.22.100 TCP 8080 > 1304 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 22 13.391540 192.168.22.100 192.168.22.1 TCP 1304 > 8080 [ACK] Seq=1 Ack=1 Win=65535 Len=0 23 13.391954 192.168.22.100 192.168.22.1 HTTP GET http://www.pouseele.be/ HTTP/1.1 24 13.394582 192.168.22.1 192.168.22.100 HTTP HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. ) (text/html) 2. IE DNS method: ----------------- DHCP ACK do not contain option code 252. No. Time Source Destination Protocol Info 1 0.000000 192.168.22.100 255.255.255.255 DHCP DHCP Inform - Transaction ID 0x8d0d16ce 2 0.008601 192.168.22.2 192.168.22.100 DHCP DHCP ACK - Transaction ID 0x8d0d16ce 3 4.779755 192.168.22.100 255.255.255.255 DHCP DHCP Inform - Transaction ID 0x8d0d16ce 4 4.785769 192.168.22.2 192.168.22.100 DHCP DHCP ACK - Transaction ID 0x8d0d16ce 5 13.273400 192.168.22.100 192.168.22.2 DNS Standard query A wpad.intranet.splab.net 6 13.278922 192.168.22.2 192.168.22.100 DNS Standard query response CNAME isa.intranet.splab.net A 192.168.22.1 7 13.283118 192.168.22.100 192.168.22.1 TCP 1267 > http [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 8 13.298734 192.168.22.1 192.168.22.100 TCP http > 1267 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 9 13.298760 192.168.22.100 192.168.22.1 TCP 1267 > http [ACK] Seq=1 Ack=1 Win=65535 Len=0 10 13.299129 192.168.22.100 192.168.22.1 HTTP GET /wpad.dat HTTP/1.1 11 13.302236 192.168.22.1 192.168.22.100 HTTP HTTP/1.1 200 OK (application/x-ns-proxy-autoconfig) 12 13.302258 192.168.22.1 192.168.22.100 HTTP Continuation or non-HTTP traffic 13 13.302277 192.168.22.100 192.168.22.1 TCP 1267 > http [ACK] Seq=115 Ack=2921 Win=65535 Len=0 14 13.308849 192.168.22.1 192.168.22.100 HTTP Continuation or non-HTTP traffic 15 13.499129 192.168.22.100 192.168.22.1 TCP 1267 > http [ACK] Seq=115 Ack=2936 Win=65520 Len=0 16 13.509106 192.168.22.1 192.168.22.100 TCP http > 1267 [FIN, ACK] Seq=2936 Ack=115 Win=65421 Len=0 17 13.509206 192.168.22.100 192.168.22.1 TCP 1267 > http [ACK] Seq=115 Ack=2937 Win=65520 Len=0 18 13.509509 192.168.22.100 192.168.22.1 TCP 1267 > http [FIN, ACK] Seq=115 Ack=2937 Win=65520 Len=0 19 13.511300 192.168.22.1 192.168.22.100 TCP http > 1267 [ACK] Seq=2937 Ack=116 Win=65421 Len=0 20 13.528225 192.168.22.100 192.168.22.2 DNS Standard query A isa.intranet.splab.net 21 13.529485 192.168.22.2 192.168.22.100 DNS Standard query response A 192.168.22.1 22 13.532855 192.168.22.100 192.168.22.1 TCP 1268 > 8080 [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460 23 13.539081 192.168.22.1 192.168.22.100 TCP 8080 > 1268 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 24 13.539106 192.168.22.100 192.168.22.1 TCP 1268 > 8080 [ACK] Seq=1 Ack=1 Win=65535 Len=0 25 13.539545 192.168.22.100 192.168.22.1 HTTP GET http://www.pouseele.be/ HTTP/1.1 26 13.541505 192.168.22.1 192.168.22.100 HTTP HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. ) (text/html) Has anybody seen that before and what can be done about it? Best Regards, Stefaan