We have since more than a week have had a very slow internet connection. I have then looked at the traffic through our gateway (windows server 2008, 2 NIC (Internal & External),Forefront) by using wireshark and discovered that a lot of traffic is originating from a specific source IP-adress (protocol mainly TCP). When I try to ping this IP I do not get any answer. In the LAN DNS there is no entry with that IP. How can the source be an IP which does not exist?