Re: runaway client access. was system under attack?

["Jeffrey Silberberg" <jsilberberg@xxxxxxxxxxxxxx>]

Okay,

Check here for the latest and greatest stuff !!!
http://www-1.ibm.com/servers/eserver/iseries/clientaccess/casp.htm


Jeffrey M. Silberberg
Independent Consultant
CompuDesigns, Inc.
Atlanta, GA.

AS SOON AS I KNOW THE ANSWERS
THEY CHANGE THE QUESTIONS

----- Original Message -----
From: srichter <srichter@mail.autocoder.com>
To: <midrange-l@midrange.com>
Sent: Thursday, August 16, 2001 3:29 PM
Subject: Re: runaway client access. was system under attack?


> Gary, Jeffrey,
>
> We use client access v3r2m1 sf57702 in the remote branches. Our 720 is at
v4r4.
>
> Two of the branches use it to print to a network printer: client access
print screen button, print from excel, ...
>
> Yesterday, a local pgmr ( not me<g> ) was trying to get network printing
to work from cae. That person ran StrTcpSvr *NetSvr on the as400.
>
> >From that point on the prior described problem and symptoms occured. Pc's
hung when they tried to print, qpwfservso jobs running without end on the
as400, lots of netstat activity, reams of cpiad09, cpiad12 msgs in the
history log.
>
> Talked to a good tech at ibm support named Shane. He had me EndTcpSvr
*NetSvr.  Problem gone.
>
> End of story.
>
> Thanks for the help,
>
> Steve
>
> ---------- Original Message ----------------------------------
> From: Gary L Peskin <garyp@firstech.com>
> Reply-To: midrange-l@midrange.com
> Date: Thu, 16 Aug 2001 10:51:41 -0700
>
> >Is it still from the same single IP address?  Perhaps you could find out
> >who that is and have him/her update to the latest service pack.  In the
> >meantime, you can stop the flood and filter out traffic to the 400 using
> >Operations Navigator and IP filtering.
> >
> >gary
> >
> >srichter wrote:
> >>
> >> You were right Gary.
> >>
> >> The problem is something with client access and the 400.
> >>
> >> The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap"
netstat entries to end, then StrHostSvr *SvrMap.
> >>
> >> When I did that at 12pm today, there were 8 QPWFSERVSO jobs in
WrkSysAct using 40% of our very fast 720.  With 10's of thousands of CPIAD09
and CPIAD12 msgs in the history log.
> >>
> >> Now I look on the system an hour later, and its back.  So, its time to
get back on the phone to ibm.
> >>
> >> Steve Richter
> >>
> >> ---------- Original Message ----------------------------------
> >> From: Gary L Peskin <garyp@firstech.com>
> >> Reply-To: midrange-l@midrange.com
> >> Date: Wed, 15 Aug 2001 21:11:15 -0700
> >>
> >> >Steve --
> >> >
> >> >I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
> >> >
> >> >  139 - Netbios (Network Neighborhood/NetServer)
> >> >  449 - Server mapper
> >> > 8470 - Central server
> >> > 8473 - File server
> >> >
> >> >I've already mentioned the File server.  The central server is used
for
> >> >license management and ASCII<->EBCDIC conversion so I'm pretty
> >> >comfortable that we have an errant Client Access Express issue here.
> >> >
> >> >You can filter out all traffic from the offending IP address using
> >> >Operations Navigator as described here:
> >>
>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1
CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
> >> >
> >> >Then, just wait for a call in the morning from someone complaining
that
> >> >they can't connect to the 400.
> >> >
> >> >Gary
> >> >
> >> >srichter wrote:
> >> >>
> >> >> Jeffrey,
> >> >>
> >> >> The branch/site that is the source of the trouble only has win95
pc's.  Only 1 pc shows up with activity in NetStat right now. NetStat shows
the local port as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ). The
remote port keeps on incrementing by 2 within the range of 1500 to 4000.
> >> >>
> >> >> Steve Richter
> >> >_______________________________________________