Oops... *shame on me* Just noticed that source.rfc822.org -> ftp2.de.debian.org (switched to that one because ftp.de.debian.org seemed down) It must have been apt-get update that tried to use active FTP which got blocked by the firewall and logged by snort... Excuse me for waisting everybodies precious time... Dries