http://blogs.technet.com/yuridiogenes/archive/2008/10/19/using-netmon-3-2-to-identify-an-unexpected-traffic.aspx1. Understanding the Problem I already worked in many cases where customer wants to know why ISA is alerting that it might be under attack by logging events such as: Figure 1 – Number of TCP Connections. …and also this one: Figure 2 – Denied Connectionsen-USCommunityServer 2.1 SP1 (Build: 61025.2)