A box was down earlier, you could ping it but, the site itself was down. Net 9 messages suppressed Suspect short first fragment eth0 PROTO=6 2xx.xxx.xxx.xxx:0 xxx.xxx.xxx.xxx:00 l=20 s-0X00 the first IP addy ( the x's, of course ) is foreign, the second is the box's ip. was the box hacked or something else? thanks, Chris _______________________________________________ Redhat-list mailing list [EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list