впрочем, оказалось, что это небольшой DDoS по http :)
[stalker@mail ~]$ netstat -m 30977/16303/47280 mbufs in use (current/cache/total) 7735/327/8062/262144 mbuf clusters in use (current/cache/total/max) 7735/229 mbuf+clusters out of packet secondary zone in use (current/cache)
0/0/0/0 4k (page size) jumbo clusters in use (current/cache/total/max) 0/0/0/0 9k jumbo clusters in use (current/cache/total/max) 0/0/0/0 16k jumbo clusters in use (current/cache/total/max) 23214K/4729K/27944K bytes allocated to network (current/cache/total)
0/0/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters) 0/0/0 requests for jumbo clusters denied (4k/9k/16k) 401/920/6656 sfbufs in use (current/peak/max) 0 requests for sfbufs denied 0 requests for sfbufs delayed
45950 requests for I/O initiated by sendfile 238 calls to protocol drain routines