Hi Johann, The thing I would look more closely at is the destination address and then do a reverse lookup on those addresses. HTH, Tom Thomas W Shinder www.isaserver.org/shinder <http://www.isaserver.org/shinder> ISA Server and Beyond: http://tinyurl.com/1jq1 <http://tinyurl.com/1jq1> Configuring ISA Server: http://tinyurl.com/1llp <http://tinyurl.com/1llp> -----Original Message----- From: Johann Putter [mailto:JohannP@xxxxxxxxxxxxx] Sent: Tuesday, February 04, 2003 12:19 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: User Authentication prompts http://www.ISAserver.org Tom They are all Web Proxy clients. Ok, I will set this in motion tracing the traffic. What do I look for in the Web Logs? Thanks so far. Johann Putter =============== IS Manager AFRICON Engineering International (Pty) Ltd 1040 Burnett Street Hatfield South Africa Tel: +27 12 427-2258 Fax:+27 12 427-2951 Cell: +27 82 553 8540 Web: www.africon.com <http://www.africon.com> -----Original Message-----