We normally identify them (in reports and what not) as being the orders where the LastIPAddress shown is the public IP address of our office. All outbound connections coming from inside our firewall...