But his logs say his station was pinging the remote host, not the otherway around.
ok, i reread the original post by geordon vantassle. i'm sorry, i just scanned through it without reading the message carefully ... as far as i understand this post, there was a traceroute-attempt from 192.168.1.1. it reached 192.168.1.20 which then tried to ping 207.26.131.137. geordon also said, that a box wasn't alive at the time. i don't get which box wasn't alive - 192.168.1.20 or 207.26.131.137? geordon, if 192.168.1.20 wasn't alive and tried to ping 207.26.131.137, then don't panic but be carefull - maybe someone spoofed an ip-address and became part of your local net. if 207.26.131.137 wasn't alive, then there's just another box on the internet switched off ... do you know, who initiated the traceroute? regards, stefan