Thanks for the reply. I do have Wireshark running, in fact that's actually what alerted me to the traffic. I don't know of a way to get it to reveal the PID of the process that's doing the listening though. I've had a look through the help manual and I don't see anything of relevance. Do you have any idea of how I might use it to do what I need?