partial answer, someone bunged up a WINS server setting

[ke...@network-services.uoregon.edu]

Seems like phloem was getting buried in port 137 ICMP and
port 138 ? ICMP requests... among other things. We fixed by
running a "nmbd" on phloem. It was amazing how they all
just disappear when we start the nmbd, and how they come back
when we stop it.

Here's some of the mis-directed evil beasts. If anyone can
suggest a reason why these vultures would think that phloem
is a WINS server, please let us know:

DAVE - 128.223.37.232
UOREGON - 128.223.37.232
MARJORIE-348 - 128.223.134.113
PROTEUS - 128.223.134.113

We also did some tuning to guard against ping flodding or
smurfing, but we're not sure yet if that is going to help
or not. Hopefully it will.

But we are seeing some shennanigans from the dialin pool,
so I think we have other firehoses to sever.

This is the first complete denial-of-service we have seen
successfully launched, so I would bet we will be discussing
this at length tomorrow.

Who was it who said that IP was a good idea?

;-(
/jgk