Thank you for the information. I noticed when I rebooted one of the servers that has a number of the strange ports listed, the ports went off. Then sometime before the next morning when I checked again, they were on.

Can I leave wireshark on and have it post to a log that I can check from time to time to see if the ports are on and what turned it on? Is it very resource intensive becuase the server with alot of the ports on is a production server.

Thank you very much.

Christine