Right ... thanx again ... useful info. Still didn't give me a reason for 3002, 3004, and 5000 to be active. Not overly concerned, since this machine is behind a 3com router which shows as stealthed on those ports, so they aren't listening beyond my house. Still, curious what they might be ... the only google info I can find on 3002 relates to a program, xic, i have never heard of ... for backend management of things ... hmmmm ... curious