Re: runaway client access. was system under attack?

["srichter " <srichter@xxxxxxxxxxxxxxxxxx>]

Neil,

Good question. The ibm tech suspected the same thing. He had me check it from 
ops navigator.  There was no conflict.

This was a very nasty bug. All because we ran "StrTcpSvr *NetSvr". 

fyi: The ibm tech did not tell me of a ptf that corrects this problem.

-Steve

---------- Original Message ----------------------------------
From: neilp@dpslink.com
Reply-To: midrange-l@midrange.com
Date: Thu, 16 Aug 2001 17:47:13 -0400

>As you are using the old CA for Win95/NT with it's own network drive 
>support, and starting Net Server, do you possible have a conflict by using 
>the same name for NetServer as you are using for CA network drives.  (ie. 
>not using the "default" of Q + system name for NetServer or some other 
>unique name).
>
>...Neil
>
>
>
>
>
>"srichter " <srichter@mail.autocoder.com>
>Sent by: midrange-l-admin@midrange.com
>2001/08/16 15:29
>Please respond to midrange-l
>
> 
>        To:     <midrange-l@midrange.com>
>        cc: 
>        Subject:        Re: runaway client access. was system under attack?
>
>
>Gary, Jeffrey,
>
>We use client access v3r2m1 sf57702 in the remote branches. Our 720 is at 
>v4r4.
>
>Two of the branches use it to print to a network printer: client access 
>print screen button, print from excel, ...
>
>Yesterday, a local pgmr ( not me<g> ) was trying to get network printing 
>to work from cae. That person ran StrTcpSvr *NetSvr on the as400. 
>
>>From that point on the prior described problem and symptoms occured. Pc's 
>hung when they tried to print, qpwfservso jobs running without end on the 
>as400, lots of netstat activity, reams of cpiad09, cpiad12 msgs in the 
>history log. 
>
>Talked to a good tech at ibm support named Shane. He had me EndTcpSvr 
>*NetSvr.  Problem gone.
>
>End of story.
>
>Thanks for the help,
>
>Steve
>
>---------- Original Message ----------------------------------
>From: Gary L Peskin <garyp@firstech.com>
>Reply-To: midrange-l@midrange.com
>Date: Thu, 16 Aug 2001 10:51:41 -0700
>
>>Is it still from the same single IP address?  Perhaps you could find out
>>who that is and have him/her update to the latest service pack.  In the
>>meantime, you can stop the flood and filter out traffic to the 400 using
>>Operations Navigator and IP filtering.
>>
>>gary
>>
>>srichter wrote:
>>> 
>>> You were right Gary.
>>> 
>>> The problem is something with client access and the 400.
>>> 
>>> The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap" 
>netstat entries to end, then StrHostSvr *SvrMap.
>>> 
>>> When I did that at 12pm today, there were 8 QPWFSERVSO jobs in 
>WrkSysAct using 40% of our very fast 720.  With 10's of thousands of 
>CPIAD09 and CPIAD12 msgs in the history log.
>>> 
>>> Now I look on the system an hour later, and its back.  So, its time to 
>get back on the phone to ibm.
>>> 
>>> Steve Richter
>>> 
>>> ---------- Original Message ----------------------------------
>>> From: Gary L Peskin <garyp@firstech.com>
>>> Reply-To: midrange-l@midrange.com
>>> Date: Wed, 15 Aug 2001 21:11:15 -0700
>>> 
>>> >Steve --
>>> >
>>> >I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
>>> >
>>> >  139 - Netbios (Network Neighborhood/NetServer)
>>> >  449 - Server mapper
>>> > 8470 - Central server
>>> > 8473 - File server
>>> >
>>> >I've already mentioned the File server.  The central server is used 
>for
>>> >license management and ASCII<->EBCDIC conversion so I'm pretty
>>> >comfortable that we have an errant Client Access Express issue here.
>>> >
>>> >You can filter out all traffic from the offending IP address using
>>> >Operations Navigator as described here:
>>> 
>>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
>>> >
>>> >Then, just wait for a call in the morning from someone complaining 
>that
>>> >they can't connect to the 400.
>>> >
>>> >Gary
>>> >
>>> >srichter wrote:
>>> >>
>>> >> Jeffrey,
>>> >>
>>> >> The branch/site that is the source of the trouble only has win95 
>pc's.  Only 1 pc shows up with activity in NetStat right now. NetStat 
>shows the local port as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ). 
>The remote port keeps on incrementing by 2 within the range of 1500 to 
>4000.
>>> >>
>>> >> Steve Richter
>
>
>
>
>_______________________________________________
>This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
>To post a message email: MIDRANGE-L@midrange.com
>To subscribe, unsubscribe, or change list options,
>visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
>or email: MIDRANGE-L-request@midrange.com
>
>