Ahriakin wrote: With generic sound protocols I sometimes have more luck doing a DNS lookup on the external IP for some hints as to what it might be. If it's a generic ISP's DHCP client then I'm more likely to turn it off an wait to see who comes asking about it. If not then the name may help, e.g. had a wierd 8000 range port the other day but the target resolved to a shoutcast server so I had a word with the user about their audio streaming habits.