Common ploy by....
Overflowing a routers ARP Table... especially older ones that only have 2K or so to use.
What happens is that with routers that are possibly vulnerable due to "UN-attentive Administration" can be caused to restart themselves... which then reverts EVERYTHING cponnected to it to the same network until fully init'd. This is especially true with Real Routers that also do VLAN 802.1Q tagging as well as Layer-3 Switches posing as routers doing the VLAN taggin crap they *CAN* do.
The common ploy allows crackers to spoof things in that brief instant to get further along on a crack. I know I've used it to humble some admins that say thier CheckPoint Firewall is impervious... Well, when they change the default rule from anything other than REJECT, changing from Negative logic to Positive Logic or a combo of both as well as a bad order of rules... Well what you expect?
So, overall I see those errors alot on Misconfigured Public Interfaces and on Properly Configured Public Interfaces... just that someone is testing your Firewall... of course since your are Masqurading... and you have a *NIX machine in place... you should be good if they are testing... provided you have your rules right and config'd properly... Wrong Subnet mask still allows some trickery that few people would really catch, but yet allow info out or in.
The best part of the whole thing... unless you have remote logging enabled... The evidence is gone as soon as the router barfs and resets...
