look at the system logs. *possibly* you could set up verbose ipchains rules, to see, which service is tried to be accessed. but i have no idea, how dial on demand works, so this idea may be useless.
-- Hi! I'm a .signature virus! Copy me into your ~/.signature, please! -- If Windows is the answer, I want the problems back!
