Keep up with CERT advisories. Use log file parsers such as swatch and logcheck. Use page checkers to ensure the integrity of your web pages. Create a user with no permissions to run the web server. Do not run the web server as nobody.
Nobody still has permissions to do things on the server.
Use tcpwrappers to provide access control for programs spawned by inetd. 655555 NT3.51 will crash from this attack, NT4.0 won't. It is possible to send more packets than can be buffered. Ping will give IP addresses and host names. Traceroute will give routers and bandwidth.