From owner-freebsd-questions  Wed Mar 12 17:35:09 1997
Return-Path: <owner-questions>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id RAA24699
          for questions-outgoing; Wed, 12 Mar 1997 17:35:09 -0800 (PST)
Received: from intergate.hh.kew.com (ahd@ppp-kew.pn.com [204.96.41.103])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id RAA24691
          for <questions@freebsd.org>; Wed, 12 Mar 1997 17:35:03 -0800 (PST)
Received: (from ahd@localhost)
	by intergate.hh.kew.com (8.8.5/8.8.5) id UAA00860;
	Wed, 12 Mar 1997 20:34:51 -0500 (EST)
Date: Wed, 12 Mar 1997 20:34:51 -0500 (EST)
From: Drew Derbyshire <ahd@kew.com>
Message-Id: <199703130134.UAA00860@intergate.hh.kew.com>
To: ahd@kew.com, sef@Kithrup.COM
Subject: Re: did someone leave a debug flag on?
Cc: questions@freebsd.org
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

> From sef@Kithrup.COM Wed Mar 12 19:50:04 1997
> In article <199703122120.QAA15649.kithrup.freebsd.questions@intergate.hh.kew.com> you write:
> >I'm seeing these now that I turned the firewall on.  They are 
> >certainly NOT the format of the kermel messages it normally issues via
> >syslog, these come out onto a randon user session ...
> >
> >36 bytes from 207.82.198.99: Communication prohibited by filter
> >Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
> > 4  5  00 5400 656e   0 0000  f5  01 a0c0 204.96.41.103  207.82.250.95 
>
> They are not kernel messages; ping has been changed to print out more useful
> information in some cases, it seems.

Yea, it was a DUF (Dumb User F--kup, mine).  A ping got loose in
background, I later discovered with tcpdump.  (Why I didn't see it
in PS until after I did the tcpdump was beyond me....)

-ahd-