If you have asymmetric routing happening, it would explain that (traffic entering and exiting different interfaces) - or if you have made a layer 2 loop, STP on the bridge would shut off a port.

It can also be from the driver if it ran out of buffer space to process a packet or some other error condition that resulted in a dropped packet. Some drivers are nice and report the actual condition of the failure in sysctl output. For example if you have an em nic, run "sysctl -a | grep .em." and see what you get. Substitute the driver name as needed (bce, bge, igb, etc) but make sure not to put the number on the end, as in the sysctl tree it would be em.0 and not em0 or it may only have a general list of things.

Thanks Phil.  That all makes sense. I do notice something going to a site in Italy, I think it's possibly from Ntop.  I'd like to check into that. It's not a terribly urgent concern, but I do think we should know these things. -F

FAQ: Why can't I view view log files with cat/grep/etc? (clog)

How is the pfSense VM configured? Other hosts would not be able connect to it's WAN interface by default. Steve

My old board I'm using has an option I've never wanted or needed before anywhere except on pfsense.  It has an internal VGA graphics adapter and at BIOS it can be set to off. The effect is nice.  It will boot and run but there is no video at all of any kind.  The only way to change that is to clear the CMOS with a jumper.  I considered using this because I felt if the case is locked, and there is no console access going to be damn hard for someone to reset my password even with keyboard access because I've also turned off all boot options except that one drive in BIOS. Anyway, guess that also saves power - But its otherwise a crap board.  I'm surprised its working so well, but it does. No idea if you can do this with your board.

Excellent..that helped me sort it :-)

Meaning most likely your clamd has died… probably due to lack of memory. Other than that, this HAVP thing is a huge headache and simply not worth the trouble at all. P.S. This is an English-speaking forum. Why are you multiposting here? http://forum.pfsense.org/index.php/topic,65286.0.html

Cmb, sorry for the late reply but that did the trick. how do i mark it as answer?

"but I am the only person at the moment who is using this exchange server. PLUS these ACKs are coming from just 3 IPs 24/7!" So the only traffic outbound from pfsense is this exchange server, there is NO clients behind pfsense? Also the ips your seeing are NOT on the list from godaddy for their CRLs  - but yes crl is a FQDN, and its served up from a CDN so its IP will change I would assume. ;; QUESTION SECTION: ;crl.godaddy.com.              IN      A ;; ANSWER SECTION: crl.godaddy.com.        855    IN      CNAME  gdcrl.godaddy.com.akadns.net. gdcrl.godaddy.com.akadns.net. 12 IN    A      50.63.243.228 So its quite possible that IP changes.. As to the oscp ;; QUESTION SECTION: ;ocsp.godaddy.com.              IN      A ;; ANSWER SECTION: ocsp.godaddy.com.      1647    IN      CNAME  ocsp.godaddy.com.akadns.net. ocsp.godaddy.com.akadns.net. 31 IN      A      72.167.18.239 I really would watch a full sniff to see if your sending out traffic to these IPs - which don't really seem to be CRL or OSCP.

Depends what you mean by safer. From a security point of view there is probably very little to choose between the two correctly configured devices. It then comes down to the speed at which new exploits/bugs are patched and updates released. The pfSense team have a good track record there and needless to say Cisco have whole departments of programmers doing that! However if, as you say, it's not possible to apply the patches for whatever reason it doesn't really matter how quickly they are released. An important measure of security is how many hours/days your router is running code with known exploits. My opinion.  :) Steve

PPPoE relay is not bridged mode. That's for half-bridge mode I believe. You need to change the device mode to "Modem Only". http://kb.netgear.com/app/answers/detail/a_id/20310/~/setting-the-dm111pspv2-to-modem-mode-%28bridge-mode%29

I don't think you can do this with pfsense, but you should try binding services to wan 1/2 , e.g. http to wan1 and smtp to wan2 you would have to create rules and setup gateways.

thanks senser, Actually I think I am not going to continue until a more reliable builtin functionality is provided by pfsense, it would be great to have the openvpn AS's simplicity but with current pfsense I think it would create more problems than solutions.

thanks Jimp, yea I guess that would be risky, even with secure website its basically down to user auth at the headend, even if they are unable to break into, they would certainly put the system in the crapper with the traffic.

The log extracts you posted show pfSense reporting the clients decided to release their DHCP leases. You will have to look to the clients for an explanation. I expect getting an explanation for that from a Nintendo might be a challenge - does it have an event log you can examine?

Yes you will be good to go. Just make sure that the SLM2008 are Tagged ports with all vlan members needed to the 3rd floor. Also not sure how far apart the Access points are but remember the only channels that don't interfere with each other are 1, 6, and 11 @ 2.4 GHz. If your switch is not MDI-X capable then you will need a cross-over cable from switchport to switchport.

Thanks you got my point. I have 5 lives IP pool, one is assigned to pfsense wan port and I have not yet assigned any live IP to Asterisknow server. I also get your point that it good to use VPN service to connect IP phone. Actually I need know what steps should I have taken to connect my IP phones through internet.