Redhat 7.2 server lose IP address by itself

Hi,

I posted this message at 10am this morning, but it did not show up
until 4pm. So I'm posting it again.

We have a server running Redhat 7.2 Kernel version 2.4.20-18.7. The IP
address is assigned by a windows 2000 DHCP server. We are running
static DHCP based on MAC addresses. So the server can hold on to the
same IP address.

The linux box had no problem with the network at first. After about
one or two weeks, the linux box is not reachable from the network. I
can still login on the serve itself, but it took a long time. The
message is "Looking up internet address...". After logged on, all
windows lost the borders, so I can't move or resize them. I tried
"service network restart", eth0 failed - "Determining IP information
for eth0.... failed". I have to restart the server to bring it online.

This has happen three times. The second time, I did notice some
"anonymous ftp" from the log files. But I don't know how to find out
what's been done. Then I brought up iptables, allowing only ssh from
anywhere, port 53, 67:68 from the DNS and DHCP server, two specific
ports from backup server. But two days laters,
this network failure happened again. I started to think whether the
"ftp" put some malicious code on the system so that the system
automatically lost its IP address.

Could anyone give me some hint on whether it's a security issue or the
operating system itself? What kind of monitoring should I do to
troubleshoot this problem?

Thanks a lot,

Lu

Lu spilled the following:
>
> The linux box had no problem with the network at first. After about
> one or two weeks, the linux box is not reachable from the network. I
> can still login on the serve itself, but it took a long time. The
> message is "Looking up internet address...". After logged on, all
> windows lost the borders, so I can't move or resize them. I tried
> "service network restart", eth0 failed - "Determining IP information
> for eth0.... failed". I have to restart the server to bring it online.
>

ISR some similar behaviour with RedHat using NTL cable modems. I fixed the
problem by switching from pump to dhcpcd (or maybe it was the other way
around?) for the DHCP client.

HTH

Colin