On 2009-01-23, at 14:46, Steven Lisson wrote: > I agree with seeing no traffic to/from 66.230.128.15 but am still > seeing flows 'from' 66.230.160.1 Are they responses to queries? Or are they queries directed at servers in your network? The latter are to be expected, I think. Joe