> > Indeed - assuming that NT correctly captured the request. Could it be > the whole IP packet? With the IP header etc? I'll try to decode that a bit an see what I come up with...