OK, I miscounted the packets to proxy ports - there were more than three (fifteen, in fact.) I find these three interesting: FWIN 3/30/2005 9:17:04 AM -6:00 GMT 66.35.250.150 slashdot.org 39285 192.168.123.19 N/A 1080 TCP (flags:S) No FWIN 3/30/2005 9:17:10 AM -6:00 GMT 66.35.250.150 slashdot.org 39289 192.168.123.19 N/A 3128 TCP (flags:S) No FWIN 3/30/2005 9:17:18 AM -6:00 GMT 66.35.250.150 slashdot.org 39297 192.168.123.19 N/A 8080 TCP (flags:S) No My guess is that slashdot is checking to see if my IP addess has an open proxy so that they can know to reject my postings (on the theory they are bogus postings through the open proxy.) (Unlike many I don't get bent out of shape over tests directed at my IP address.)