On Tue, Jul 01, 2003 at 07:43:04AM -0400, Jean-Luc Wasmer wrote:
> Didn't your copy (sent directly to your addresss) have the attachment?

Yes, but as it was Cc: to tech-net I deleted it from my main box.

> 
> Anyway, it's available here:
> 
> http://www.geocities.com/Paris/Metro/1624/tcpdump.txt

Are you sure your IP connectivity is OK when this happens ?
The only aserws comming in seems to be from mag2.magmacom.com, which
is routed from the same ISP as you (magma.ca) from what I can see.

Another thing I would check is the error rate on the interface, with
netstat -i
Hum, and just to be sure, is your server behind a firewall ?
Note that all requests that don't get anserwed come from port 65534.
The ones to mag2.magmacom.com.domain come from port 57301
After restart it starts using port 57248 and works again.
Wasn't 65534 the port used by a trojan ? Maybe it's filtered somewhere ?
Maybe try to force the port used for query to a fixed, high-number port
(it's the query-source option, if I remember properly)

-- 
Manuel Bouyer <bouyer@antioche.eu.org>
     NetBSD: 24 ans d'experience feront toujours la difference
--