Thanks for the reply... No, I had thought of that earlier and made sure that the old scope was deactivated and deleted and the new scope is in effect. I checked the ISA event log and the RRAS services are picking up a range in the new scope also. I just checked my logs again and I'm still seeing this traffic every few seconds. If there are any other ideas, I'm completely open- I've been trying to track this down for almost a week now. Thanks again. Later, jon. john.hall@xxxxxxxxxx