I manage a windows 2000 server and ive got a watchguard III 700 firewall. Ive noticed in the firebox system manager on the traffic monitor tab, it looks like someone is accessing our system when they should not be. The monitor says it allowed traffic from ip address 18.104.22.168 to different external addresses on my network. They are using port 5900 which i opened to enable remote access for VNC for certain users. There is also many denied attempts to get through the firewall with ping attempts and in addition there is some traffic trying to get through with a spoofed source address. What is going on and what can i do to strengthen the security on my network. Thanks in advance!