An old thread on the Overclockers forum suggests that this is a problem with apinger, the monitoring daemon. apinger is a very troublesome piece of code. In 2.3, apinger has been replaced by dpinger, which is vastly superior. Repeat your tests with the latest 2.3 beta snapshot - if the issue cannot be reproduced there, then the issue is resolved in a forthcoming version and no further effort need be expended on investigating the issue. Though it is still a beta version, the pfSense 2.3 base system is now pretty stable and contains numerous valuable fixes over pfSense 2.2. The main shortcoming of 2.3 at this time is with packages - some packages are unavailable for 2.3 whilst others do not have a fully functional GUI. To get a failed pre-2.3 system back into operation, the chances are that all you need to do is restart apinger (for example using Status -> Services). If you don't need gateway monitoring, you may be best choosing "Disable gateway monitoring" for the affected gateway(s) until such time as you can upgrade to 2.3.

Thanks, that worked.

I am currently using VOIP.  It is set up on my LAN behind my (off the shelf) D-link router.  As far as I know, nobody has has invaded my network - this was more of a theoretical question, as I pondered whether there might be a security vulnerability in my network (i.e. could someone take over my VOIP device and use it to launch an attack on other devices in my LAN?).  Would it be considered best practice to run the VOIP on its own vlan or is that overkill? And also for open VPN - this was also theoretical - how difficult would it be for someone to penetrate through that hole if I used 2048 or 4096 bit keys, and combined it with user authentication?

Thanks. I'll keep an eye on internet connection.

=changed OS to 2.2.4 and it works =replaced the ssd and it works with 2.2.6 as well

ok that did not seem to matter I set the MTU to 1470 and no difference. I even ran ifconfig and the settings did change to 1470 in there. Does the hard drive affect the throughput on the network cards? I have another PC in the shed I might drag it out and test that. See if it produces the same results, I had another 3 NIC brand new as well in the shed will try them also but this board only has 1 PCI slot why I had to go with a seperate dual port intel card for it lol

OK, thanks jimp. I'll have to change path for these logs.

you should be able to replicate a outage by unplugging the cable from your modem, The one that comes from the wall socket. I wouldnt pull out the cable between the modem and PFsense as it could be a miss match in communication from the modem and router. As I say mine works fine on the default autoselect (one at the very top) but not when its just plain autoselect. But if you know what it always uses then setting it manually like you have should work. Just run some test to make sure it is not affecting performance.

Increase mbufs. See nic tuning on the wiki

Ping doesn't actually measure network latency, it measure's network latency plus the network stack of the host OS. It's very possible you're just seeing network scheduling fluctuations.

@lovene: I need to audit all firewall activity but cannot achieve this. I need to print audit reports of all changes. Exactly what do you mean by "all firewall activity"?  All packets in and out, blocked packets, passed packets?  Logins?  File changes? "All" has the potential to cover a lot of ground, specific help requires specificity of what you are trying to accomplish.

whats the output of ifconfig -a?  Is your WAN interface at the correct speed and duplex?  What did you do with "traffic shaping"?

I see squid running. I bet you had a memory spike once or more that caused some pages to get swapped out, but those pages have yet to be referenced again and just stay in limbo until the next time they are needed. Also, you don't need to reach 100% memory usage to get paging. Memory gets fragmented and if there are no large enough contiguous segments, the kernel may need to swap out pages to effectively defrag the memory.

@Derelict: pfSense will do multiple scopes just fine. It just can't be configured to accept helper requests from multiple subnets on one interface. Well that's just silly.