I've never seen this log before (split lines). Is it simply someones modem noise How can it have two SRC addresses? Feb 27 17:50:37 sky1 kernel: fw-drop IN=eth1 OUT= MAC=.... SRC=216.200.115.66 DST=80.5.144.39 LEN=56 TOS=0x00 PREC=0x00 TTL=247 ID=0 PROTO=ICMP TYPE=11 CODE=0 [SRC=80.5.144.39 DST=200.179.192.14 LEN=40 TOS=0x00 PREC=0x00 TTL=1 ID=12701 PROTO=TCP INCOMPLETE [8 bytes] ] -- regards -- Graham Information-Cascade (at) ntlworld.com