Wow there was a massive bombardment of authentication requests on HTTP and FTP at the same time on win21, for about 8 minutes, this looks ot be the cause of IIS slowing down. I am blocking a large number of IPs that particiated in this attack now.
I have blocked the main source IPs and down from over 10000 invalid requests a minute to just 2-3, the server can easily handle much mroe than 2-3 invlaid requests, but was getting bogged with masses of them.
There was just a blip on the network as some new blocks took place. This was unintentional to cause s brief network drop drop, but needed to continue blocking more attacking IPs.