Thank you for all your responses. With all your help we have narrowed it down to a software bug and a customer running a port scan. We were running Version 12.1(3a)T2 IOS and one of our customers decided to run a port scan (We called them and asked what was he doing). Someone told us to look for '%RCMD-4-RSHPORTATTEMPT:', we did and found it just a few seconds before the router rebooted. He referenced that attempt with the IOS a determined it was Cisco bug CSCds07326. We have since upgraded our routers to the current IOS. Again thanks for all your help. Shawn. -----Original Message----- From: Andrew Fort [mailto:afort@choqolat.org] Sent: Thursday, November 15, 2001 6:01 PM To: Zhang, Anchi Cc: Gyorfy, Shawn; cisco-nsp@puck.nether.net Subject: Re: [nsp] Cisco 7206 Reboot / Bus Error On Thu, Nov 15, 2001 at 09:00:39AM -0600, Zhang, Anchi wrote:

problem. Maybe my problem is related to CSCdv06207 though I seem luckier that the router does not crash.

I've heard that sort of problem rumored on the list recently; you may like to have a look through the archives (on marc.theaimsgroup.com). CSCdv06207 is not triggered by the operator, rather it's triggered by timing of flow expiry in the router for the NBAR and ACL processes.