Regarding my previous e-mail, I just realized maybe one way of dropping packets is if I replace the "^alert" keyword with "drop" in the rules. However, is this the correct way? Thanks, Vieri