The denial of service attack ended before we were able to determine the source or nature.  It was odd in that it neither saturated bandwidth or CPU according to the router statistics but still slowed things down.  I’m working on configuring more detailed logging to hopefully gain a better understanding if it reoccurs.