It has been my experience that this would be a PCI issue as interrupts occur 
for the PCI bus that the card is on. It may help to look at your motherboard 
docs and see if you have more that one PCI bus and make sure the eth card is 
on a bus by its self. This could also be overloading the CPU but not likely. 

>
> Apr 11 16:56:52 fw kernel: eth0: Too much work at interrupt,
> IntrStatus=0x0001.
>

Portsentry is a good idea. Do you know what port they are syn flooding
try using tcpdump to get a trace of it. I would be happy to look at the dump 
for you. 

use some thing like this, when it happens. 

tcpdump -nn -i eth0 dst net <your IP>


-- 
Chief Security Engineer | Daniel Fairchild [EMAIL PROTECTED]
GCS d- s++:++ a- C++ UL++++ P+++ L+++ E--- W++ N++ o+ K- w+
O M- V PS+ PE Y+ PGP+ t 5+ X-- R+ tv b++ DI++ D


Reply via email to