[rn4it]

Thanks,
it's our smtp server so the public IP is being NAT'd to a private address. We have a E10 which during business hours hits appx 70% utilization, so I don't want to capture all traffic. Should I add the private address into the fw monitor filter?

thanks
JT