That's flow based not packet based. You're running it as a firewall rather than router therefore any of the typical thinks that overwhelm stateful devices - rapid session setup, high levels of ICMP with embedded headers to decapsulate, etc - could be causing it. -- Sent from my mobile device, please excuse brevity and typos