There is just one which is sending at 60s interval. When restarting the heartbeat client daemon though a few messages might happen to be sent in a short time-frame (due to the way init respawns dying processes) Around 10:30 CEST this morning I did manually restart the heartbeat daemon to check why the tunnel did not come up as saw the Port Unreachable ICMP errors. Alternatively some buffering on the CISCO router when it thinks it's ADSL link has to be retrained can also cause a burst (it takes about 1 minute to retrain but PPPoE session remains alive) - not sure the router does buffering in this case. Though as I did not change anything on my setup recently I'm surprised to have hit a limit. The system booted this morning around 8 CEST, do you know when the ratelimit overrunning happend? Looking up my logs I see: Jun 23 11:47:41 aphrodite ntpd[2029]: adjusting local clock by -0.274020s Jun 23 11:50:23 aphrodite ntpd[2029]: adjusting local clock by -0.203187s Jun 23 12:45:29 aphrodite ntpd[2029]: adjusting local clock by -0.150385s Jun 23 12:55:57 aphrodite ntpd[2029]: adjusting local clock by -0.360274s Jun 23 13:01:13 aphrodite ntpd[2029]: adjusting local clock by -0.333676s Jun 23 13:04:09 aphrodite ntpd[2029]: adjusting local clock by -0.264828s Jun 23 13:07:10 aphrodite ntpd[2029]: adjusting local clock by -0.195618s Jun 23 14:16:32 aphrodite ntpd[2029]: adjusting local clock by -0.407195s Jun 23 14:22:26 aphrodite ntpd[2029]: adjusting local clock by -0.385334s Jun 23 14:25:32 aphrodite ntpd[2029]: adjusting local clock by -0.323251s Jun 23 14:29:14 aphrodite ntpd[2029]: adjusting local clock by -0.276485s Jun 23 14:31:55 aphrodite ntpd[2029]: adjusting local clock by -0.202399s Jun 23 14:37:18 aphrodite ntpd[2029]: adjusting local clock by -0.148212s Jun 23 15:32:10 aphrodite ntpd[2029]: adjusting local clock by -0.329207s Jun 23 15:39:52 aphrodite ntpd[2029]: adjusting local clock by -0.339359s Jun 23 15:43:53 aphrodite ntpd[2029]: adjusting local clock by -0.270805s Jun 23 15:47:35 aphrodite ntpd[2029]: adjusting local clock by -0.195101s Jun 23 15:52:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:53:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:54:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:55:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:56:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:57:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:58:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 15:59:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused Jun 23 16:00:01 aphrodite heartbeat: Failed sending heatbeat: Connection refused So looks like the burst must have happend yesterday afternoon though the tunnel remained alive till late that evening...