Subject: EAM no joke
From: [email-masked]
To: [email-masked]
Date: Thu, 6 Apr 89 0:53:41 EDT

Folks,

In the last 240 hours dcn5 has processed 462K NTP messages, or a flux of
0.53 messages per second, which would seem it has 120 peers all
poking at the minimum polling interval and thus presumably synchronized
to it. It happens to have about 30 symmetric-mode peers plus a handful
of client peers. The discrepancy in rate is probably due to the problem
pointed out by previous Emergency Action Messages (EAM). That's bad,
but livable.

In the last 32 hours the problem has grown much worse and very serious
at dcn1. In this interval dcn1 processed 261K messages, or a flux of 2.26
messages per second. However, the critter is DES-limited at something
between 3 and 6 messages per second! The load has become so bad that I
can no longer monitor it with NETSPY, the Fuzzball monitoring protocol of
choice. It, too, has only about 30 symmetric-mode peers plus a handful of
client peers, so whatever is gouging dcn5 is slashing great holes in 
dcn1 flesh. Clearly the machine-gun bursts from the hosts listed in
pevious EAMs is threatening disaster, especially since dcn1 is the 
gateway to ARPANET here. 

Now, were I to resist the urge to authenticate at least the non-Fuzzball
peers, the throughput limit would probably rise to something reasonable,
like 20-40 messages per second. However, I am much concerned that not only
dcn1 is taking hits but all the other Fuzzballs out in the swamps. Therefore,
I am asking the timecallers on nets 128.143 and 128.153 in particular to
investigate and upgrade to the latest version post-haste. Not the least of
my concerns is that the present traffic levels has become most visible
relative to the rest of the campus traffic combined. Properly operating
NTP peers should be pinging at 1020-second intervals, not one-second
intervals. Those one-second honkers are thus 30 decibels above the noise
level.

You should know the following:
Circuit QUEBEC: frequency 6761 upper-sideband, common SAC broadcast
ELECTRIC: US airborne command post, formerly SILVERDOLLAR
SKYKING: collective identifier for any SAC aircraft aloft
CROWN: White House Communications Agency
ACROBAT: Andrews AFB (near WashDC)
CAPSULE: collective identifier for any Military Airlift Command (MAC)
aircraft aloft
COVEREDWAGON: confirmed hostile act
DROPKICK: SAC Heaquarters Offut AFB NE
DULLSWORD: nuclear incident
GOLDCOIN: MacDill AFB, FL, Strike Command Control (also overheard directing
drug-intercept missions)
SENTRY: AWACS aircraft (E3A) from Tinker AFB, OK
CRITIC: highest communications priority
EAM: Emergency Action Message

Toss that in your trivia bucket. My next lesson will be in Navy communications
COMSLANT and send torpedoes.

Dave