Hi Tom, You're right; it's just the SMTP filter spewing what it received into the event log. That string is definitely outside the "20 char" lmitation for a NOOP. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! http://www.ISAserver.org Hey folks, Here's another very interesting entry in my log. I don't think its ISA Server generating this "helpful" message: ====================================== -----Original Message----- From: SMTP_Intrusion [mailto:SMTP_Intrusion] Sent: Tuesday, March 11, 2003 10:38 PM To: insider Subject: ISA Server alert: The SMTP command exceeded its allowed length ISA Server name: EXETERT2 NOOP *** See <http://www.hexillion.com/MailAdmin/> for an explanation of this session ====================================== Thomas W Shinder www.isaserver.org/shinder ISA Server and Beyond: http://tinyurl.com/1jq1 Configuring ISA Server: http://tinyurl.com/1llp ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Exchange Server Resource Site: http://www.msexchange.org/ Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')