what has been done to foot-print the issue? the who's, when's, what's...? for a moment i thought it might be a cable/dsl modem firmware issue, but the dial-up scenarios preclude that (in all likelihood any arp cache issues as well). also, theyre obviously using different hardware dial-up v. c/dsl modem, so the prospect of a hardware fault drops to a low probability. if i'm not mistaken, and i quite well may be, i think winxp rebuilds the tcp/ip stack on reboot, which could go a long way towards explaining the issue. since it's happening to a number of systems the best avenue of attack, imo, is to identify commonalities amongst the systems/access patterns of the end-users (e-u's). are these ppl running specialized, or private use, s/w that other winxp e-u's arent? are they jumping off of the same link/page/site? are they connecting to the same respective network presences (dial-up & c/dsl)? same time of day? is it possibly a server-side rather than client side issue propogating a corruption/conflict to these e-u's? ....