From owner-freebsd-current@FreeBSD.ORG Fri Apr 22 17:35:04 2005 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9325D16A4CE for ; Fri, 22 Apr 2005 17:35:04 +0000 (GMT) Received: from pne-smtpout2-sn1.fre.skanova.net (pne-smtpout2-sn1.fre.skanova.net [81.228.11.159]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4728C43D2D for ; Fri, 22 Apr 2005 17:35:04 +0000 (GMT) (envelope-from daniel_k_eriksson@telia.com) Received: from sentinel (195.198.193.104) by pne-smtpout2-sn1.fre.skanova.net (7.1.026.7) id 42687F2000034739; Fri, 22 Apr 2005 19:35:03 +0200 From: "Daniel Eriksson" To: "'FreeBSD Current'" Date: Fri, 22 Apr 2005 19:34:59 +0200 Organization: Home Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 In-Reply-To: <17001.9557.627987.505930@roam.psg.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 Thread-Index: AcVHV/BYTU/fDlNWR4yXXD4f969IQAACMiog cc: 'Randy Bush' Subject: RE: significant increase in ipfw pullup failed X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Apr 2005 17:35:04 -0000 Randy Bush wrote: > previously i got an ipfw pullup failed a couple of times a day > now i get them every few minutes I've gone from naver having seen one to 5-10 per day over the last week. Intel Pro/1000 (em) network card in one of the servers, VIA Rhine II (vr) in the other. They seem to happen at the same time on both servers even though they are hooked up to a switch, so that means some sort of broadcast. Could be the result of some new virus perhaps? At least one machine on the local segment is spamming snmp-trap broadcasts, possibly indicating some sort of virus propagation. /Daniel Eriksson