Thank you for all the information. It gives me a few choices to maul over. Right now the single largest issue are compromised PCs that are abused for sending SPAM and also send viruses. I am seriously considering the idea of forcing all smtp traffic through a mail relay of some sort. The newest viruses are smart enough to find mail servers that are available to relay through on the network. So it is not the final answer to just have a relay. But at the very least it will provide a single point to deal with the problem. Is there a way do transparently redirect smtp traffic to a server elsewhere on the network using Cisco gear? It would be much easier to implement this solution if smtp traffic is transparently sent through the dedicated box rather than 'cutting off' all users until they manually reconfigure their clients to use the new mail relay. Adi