> > AND was it or was it not a Portscan ... this is the Question ;-) Looking at the original logs.. No, it wasn't. A port scan shows succesive destination ports, but these were all from the same src to the same destination consistently within the two blocks.