* Héctor González schrieb am 01.08.07 um 16:49 Uhr: > You might try a rule to match "state INVALID", and see if it catches > them. It might be someone probing your firewall. makes sense. The new rule matches those packets indeed. Seems like I did not pay enough attention to the TCP flags. Thanks Héctor! -Marc -- begin LOVE-LETTER-FOR-YOU.txt.vbs I am a signature virus. Distribute me until the bitter end