I have a lot of wierd entries in my FW log. I haven't looked at it in days and this is what I find. ANyone have an idea what these are? I search the web and can't really find anything except ICMP 11/0 is time to live exceded. -------------------START LOG-------------------------- Jul 7 10:35:50 manapua ipmon[13718]: 10:35:49.952009 le0 @0:11 b 24.25.225.71 -> 66.8.228.32 PR icmp len 20 56 icmp 11/0 for 66.8.228.32 - 192.168.1.2 PR icmp len 20 84 icmp 8/0 IN Jul 7 10:35:22 manapua ipmon[13718]: 10:35:21.629453 le0 @0:11 b 24.25.225.70 -> 66.8.228.32 PR icmp len 20 56 icmp 3/1 for 66.8.228.32 - 192.168.1.254 PR icmp len 20 84 icmp 8/0 IN ---------------------END LOG-------------------------- most of the entries are from 24.25.225.71 (an RR Server with telnet running) and every now and then one from 24.25.225.70 (again an RR server with telnet). My systems IP is 66.8.228.32. I have no system with a 192.168.1.0/24 address. There are also several with 192.168.0.0/24 addresses and I don't have any of those either. I have several thousand of these entries. I have checked my system and can't find anything to lead me to think it has been compromised. Do you have any clue what this is. thanks, Dusty PS - flex is still down so I am not getting luau mail. If you have anything important about this please send it to dusty@firstworld.net So I asked my accountant, do I get an agriculture exemption for my server farm?