I was reading the log column descriptions on MS site. Can someone explain what are client IP and original client IP? I saw this explanation on MS site and bit confused: Original Client IP == The IP address that distinguishes reverse secondary connections. So, if there is a server publishing rule like this: External---<EXT-NIC(136.10.10.50:80)>--ISA--<INT-NIC(10.1.1.1)>------<server:10.1.1.50:80> Assuming the initial connection is made from External, what would be the client IP and original Client IP for this rule from 10.1.1.50 point of view? Thanks --------------------------------- Do you Yahoo!? Yahoo! Mail - Helps protect you from nasty viruses.