--- Eric Rossiter wrote: > quick google... > http://www.cert.org/current/scanning.html > > scroll down to microsoft-ds tcp/445 > > HTH, > E yeah, i happened on that one. am i correct to assume that these singel instances are just probes looking for a service to exploit? i mean, 99% of my logs for today are for port 445. kurt __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com