I have been getting literally tens of thousand of lines like the following in my syslog log file over a time span of less than a minute, although the DST IP address isn't always the same. Code: Apr 11 08:40:56 gopher kernel: [40316.825244] Shorewall:fw2loc:REJECT:IN= OUT=eth1 SRC=192.168.200.100 DST=220.127.116.11 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32771 DPT=53 LEN=44 I have Shorewall running and the check configuration seems to work appropriately. It is configured with two network interfaces with the address 192.168.200.100 in the error message above being the local interface for the private LAN. The only DNS rule in Shorewall allows DNS entries from the public interface (net) to the Firewall. I don't really know why I am getting this message in my log file. I don't know if this is a DOS attack, but the result is pretty much the same. My server is so busy logging these messages that it can't serve webpages and handle email.