Hi again sorry for the reply to my own post, but I thought I'd add some additional data...
I'm seeing bad new connections from the server itself with these options: PROTO=TCP SPT=80 DPT=57520 WINDOW=16896 RES=0x00 ACK URGP=0 I'm also seeing bad new connections with these flags: PROTO=TCP SPT=2218 DPT=80 WINDOW=0 RES=0x00 RST URGP=0 PROTO=TCP SPT=2382 DPT=80 WINDOW=8576 RES=0x00 ACK FIN URGP=0 PROTO=TCP SPT=49252 DPT=80 WINDOW=33120 RES=0x00 ACK RST URGP=0 any of these "ok" or just bad ? some of them are from hosts on the local network (although not "trusted", since it's a uni-campus ;-) Cheers Simon
