i think you should e listening for conections in uncommon hours.....tcp conections to ports that aren't used by your compani....the load of the network...versus THE RAL LOAD OF THE NETWORK(what services are been used...stuff like that...)also unsuccesesfull logins...form inside the fariweall as from outside.....if you need specific help....em mail me.....faith_in_death ARROBA hotmail DOT com