[LDM #CSZ-262645]: errant LDM REQUESTs on sirocco.srcc.lsu.edu

Hi David,

This afternoon (and continuing into tonight), sirocco.srcc.lsu.edu began
issuing REQUEST after REQUEST for IDD datastreams from the Unidata toplevel
IDD relay idd.unidata.ucar.edu.  These numerous REQUESTs (over 160) resulted
in essentially a denial-of-service "attack" that led us to blacklist
sirocco on the idd.unidata.ucar.edu cluster node that was servicing the
REQUESTs.

Since we do not understand what could have caused the numerous, repeated
REQUESTs, we are requesting that we be granted login privilege to
sirocco BEFORE its running LDM is stopped and restarted or the machine
rebooted.

If granting us login access (via SSH) is not acceptable, we are asking
that you do the following:

- do a 'ps' for the user 'ldm' and send us the results

- run 'uptime' and send us the results

- run 'iostat -5' for about a minute and send us the results

- send us the LDM log file(s) that cover the period starting at approx.
  20:30 UTC Friday and covering at least through the current time which is
  about 5 UTC Saturday

- send us any output that shows abnormal behavior on sirocco or with
  network equipment that sirocco's network connection goes through
  (routers, switches, packet shapers, etc.)

After gathering as much information as you can (assuming that you
will not give us SSH access), please stop/restart your LDM:

<as 'ldm'>
ldmadmin restart

Thanks in advance for your prompt attention to this situation!


Cheers,

Tom
--
****************************************************************************
Unidata User Support                                    UCAR Unidata Program
(303) 497-8642                                                 P.O. Box 3000
address@hidden                                   Boulder, CO 80307
----------------------------------------------------------------------------
Unidata HomePage                       http://www.unidata.ucar.edu
****************************************************************************