Kevin... We are signature based, I assume there was some sort of string match that was flagged. But I thought it was odd that being a sig based IDS, we STILL saw the same thing that the original poster saw. Why? and who is that? he said something about a DNS that resolved to 3 diff names...