The one I wanted turns out to be my ISP looking for open relays ! Thanks for the response. Geoff. > > My firewall captures the IP addresses of people who "ping" my TCP > > ports. They consist of the standard four eight-bit integers. The > > firewall "whois" command is able to back-track some of these, others > > not. > > > Those *are* normal internet (IPv4) addresses. Do you mean you want to > reverse-resolve these into hostnames?