Are you sure that these are connections originating from your web server, and not just replies to connection requests from outside clients? Do they have the "syn" bit set, and only the "syn" bit, or are they "acks"? --Stafford