Hi, When I look at the firewall log for webproxy traffic, I see two lines per web request. One line is for traffic from the client to Local Host Network (ISA's internal NIC on port 8080). A second line is for the traffic from Local Host Network (Primary IP number on external NIC) to the destination webserver. Is there anyway I can have the ISA log only the internal client IP to the destination webserver IP? Also, it shows protocol as "unidentified IP traffic" as 8080 is not a well defined port number. Other protocols (or non-webproxy related traffics) shows a single line with client IP and destination server's IP. My clients have all three ISA clients installed. Thanks __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com