TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- Hi all. I am pretty new to this stuff so ... I am seeing a lot of IP duplicate events, but it seems to be false positives. I wanted to set up a filter for this event, but not block the entire event. When I go to the filter screen, it allows me to filter IP, UDP, and ICMP...Am I missing something?? Could someone help me with creating a rule to keep this event active UNLESS the proper combination of Source, Dest with the ARP protocol arises...in which case it doesn't record it. Thanks, Paul
