The keep alive packet for any connection is on the same port as the connection. The difference you are seeing is that the firewall times out the connection sooner then the keep alive packets are sent. This isn't uncommon. In fact, often times it is done intentionally to prevent you from breaching the firewall with "safe" looking programs that happen to keep an open connection and then let whatever you want through. ======= Kirk Wood Cpt.Kirk at 1tree.net Nothing is hard if you know the answer or are used to doing it.
