Ok... whew... found the problem... I was way too focused on the fact of when these started (right after the cron job), and was assuming it was a problem on the linux box... Turned out to be 3 problem entries on the (windows) dhcp server (don't ask - its not my call)... Deleted/recreated these, and the flood has stopped... I would still like to review my rules though, and make a few modifications so that the windows stuff gets silently dropped... -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html