Our BorderManager server has started acting flaky, and I'm not sure if

it's a problem with our configuration or symptoms of an attack. Twice

last week and once this week it stopped responding to network traffic.

Each time rebooting fixed the problem, but that's a poor solution.

I took the time to look things over prior to rebooting:

In Monitor, I noted that for both PRIVATE and PUBLIC interfaces the
"Receive Discarded, No Available Buffers" was going up rapidly. Under

General Info, "Packet Receive Buffers" was pegged at 10,000 (min=5000,

max=10,000) and "Directory Cache Buffers" was pegged at 4,000
(min=2000, max=4000).

In TCPCON, I noted a LOT of "FinWait1" and "FinWait2" states for
external IP addresses. There were also some "LastAck"s and
"SynReceived"s.

This server has 1.5Gb of RAM to work with, so there's plenty of room
for increasing the Packet Receive Buffers. In fact, I've doubled themin/max each time the problem occured: from 2500/5000 to 5000/10,000,and with this last reboot I bumped 'em to 5000/25,000. Funny thing
is, I haven't noticed the Packet Receive Buffers going up from the
minumum until the problem occurs. Granted I'm not sitting in front of

the server watching it 24x7...

SO - what's going on? Is it just too much traffic, or some sort of
attack? Should I just keep bumping up Packet Receive Buffers until
the problem goes away, or are there some other settings worth lookingat?

The server is a dual P4 1.4GHz with 1.5Gb of RAM, running NW6 SP3 andBM37 SP2. I can provide a CONFIG.TXT file if it would be useful...

TIA for any advice!