As alluded to by earlier posters this problem was actually hacking attempts. Although they didn't show up in the logs, I actually had to do a packet capture on the firewall, and it showed a flood of register attempts. I I blocked everything on port 5060 except for my SIP providers, and so far problem solved. Hope this helps someone else. -- Babstar