A workstation connecting to one particular legitimate website always creates a worm alert on the Mako gateway router, where the alert suggests there have been 1000+ new connections within the past 10 minutes.

I think there is some kind of incompatibility between the browser and the web app, but we need more packet level data to support this notion.

The support guys at Mako and Secureme say that details of the 1000+ sessions are not available after the event, but maybe we can set up a prior trap .. is there any way of setting some kind of trap on the Mako to give full details of the data or the connections during this localised event? 

Otherwise I guess we could put some packet sniffing software on the client? Wireshark?