you say you banned them in the gateway for ssh and ftp... what type of gateway? would you share the place you got the info from and/or the ip blocks please? thanks - rh