Each morning our user community remotely connects to the VPN Concentrator, establishes a secure tunnel, acquires a dhcp IP address and continues to work. One of the IP addresses is coming up in the syslog on CiscoWorks 2000 %RCMD-4-RSHPORTATTEMPT: Attempted to connect to RSHELL from 192.168.21.101 never the same user or location, but always the same IP address.