From owner-freebsd-questions@FreeBSD.ORG  Tue May 17 03:51:37 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8DF2A16A4CE
	for <freebsd-questions@freebsd.org>;
	Tue, 17 May 2005 03:51:37 +0000 (GMT)
Received: from proxy.ddcom.co.jp (proxy.ddcom.co.jp [211.121.191.163])
	by mx1.FreeBSD.org (Postfix) with SMTP id C0BCB43D53
	for <freebsd-questions@freebsd.org>;
	Tue, 17 May 2005 03:51:36 +0000 (GMT)
	(envelope-from rees@ddcom.co.jp)
Received: (qmail 30307 invoked by alias); 17 May 2005 04:02:55 -0000
Received: from unknown (HELO matthew) (10.10.10.11)
  by mail.ddcom.local with SMTP; 17 May 2005 04:02:55 -0000
Date: Tue, 17 May 2005 12:51:34 +0900
From: Joel <rees@ddcom.co.jp>
To: FreeBSD Mailing List <freebsd-questions@freebsd.org>
In-Reply-To: <FDE0A023-085D-4258-ABB4-805772E3E699@shire.net>
References: <FDE0A023-085D-4258-ABB4-805772E3E699@shire.net>
Message-Id: <20050517124657.2942.REES@ddcom.co.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-2022-JP"
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver. 2.00.06
Subject: Re: is this a possible DoS attack?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 17 May 2005 03:51:37 -0000

On Mon, 16 May 2005 08:26:58 -0600
"Chad Leigh -- Shire.Net LLC" <chad@shire.net> wrote
> [...]
> May 16 02:20:00 crickhollow named[87025]: zone 22.63.209.in-addr.arpa/ 
> IN: loading master file ptr.209.63.22: file not found
> May 16 02:33:31 crickhollow /kernel: Limiting icmp unreach response  
> from 232 to 200 packets per second
> May 16 03:14:52 crickhollow /kernel: All mbufs exhausted, please see  
> tuning(7).
> May 16 03:14:53 crickhollow last message repeated 3 times
> May 16 03:14:59 crickhollow /kernel: o 00:20:ed:16:b9:07 on dc0
> May 16 03:14:59 crickhollow /kernel: arp: 166.70.252.252 moved from  
> 00:20:ed:16:b9:07 to 00:20:ed:56:b9:07 on dc0
> May 16 03:14:59 crickhollow /kernel: arp: 166.70.252.252 moved from  
> 00:20:ed:56:b9:07 to 00:20:ed:16:b9:07 on dc0
> May 16 03:14:59 crickhollow /kernel: arp: 166.70.252.252 moved from  
> 00:20:ed:16:b9:07 to 00:20:ed:56:b9:07 on dc0"
> [...]

NIC in 166.70.252.252 going bad?

Some sort early morning of line noise? (I'd suggest the solar flare, but
I think that was before the weekend.)

--
Joel Rees   <rees@ddcom.co.jp>
digitcom, inc.   株式会社デジコム
Kobe, Japan   +81-78-672-8800
** <http://www.ddcom.co.jp> **