> what does the icmp_time_exceeded event mean? It's its own ICMP message (it indicated a datagram whose TTL expired, so for example traceroute uses these) - it does not have any relationship to other ICMP's timing out. Vern