All, Have an ISA Server in Cache mode. When I run reports all seems ok, except that I am seeing "UNKNOWN" in the reports. This appears in "Browsers v OS" , "Browsers" which I can understand (sort of...) Under "Protocols" though we had 320Mb traffic UNKNOWN, apart from the usual .gif etc.. Would really like to know what this is. Any ideas, clues on where to look? cheers Neil