I am wondering how much port scanning is going on out there. Our ISA logs are about 800k for a day, mostly ICMP (ping). There were over 4000 pings just in our 64.146.*.* space. BTW, I wrote a little utility that opens a log file, searches for a matching or partial IP, like 64.146.*.* and outputs all that match in a text file. It also does a rDNS lookup and inserts this info into the output file. It's written in C#, if anyone wants the source, let me know. Regards, - Robert