Re: Unknown Outbound TCP/IP Connection

["Roger Harman" <RHarman@xxxxxxxxxx>]

Just as closure(?)....

Since we took the system down on Sunday the 6th for our weekly save the
world, I have not seen a recurrence of this.  Haven't found anything yet
that looks like the culprit.  Ending TCP/IP seems to have killed it.


> > > RHarman@xxxxxxxxxx 12/04/2009 5:51:02 PM >>>
Not sure but I'm *thinking* it may be related to undeliverable email and
an attempted reply to the IBM i.  

If I catch the connection (on netstat *cnn), the attached job
(QTCP......) has a reference in the joblog to "cannot resolve to system
[my system name]".  Looks like it may be trying to do a DNS lookup.  

Two issues.... 
(1)  The DNS entry in CHGTCPDMN is *LOCAL for priority and our internal
(10.100....) is the only entry after that.
(2)  Where in the heck is that 208.....  IP address coming from?


> > > RHarman@xxxxxxxxxx 12/04/2009 2:58:47 PM >>>
Nope.  That's not it.

> > > chianime@xxxxxxxxx 12/04/2009 1:09:16 PM >>>
Maybe you're being used as a relay?  CHGSMTPA (F4) and page down 3 times
to
find ALWRLY.

On Fri, Dec 4, 2009 at 1:25 PM, Roger Harman <RHarman@xxxxxxxxxx> wrote:

> OK, this just started showing up on my system in the last couple of
> days.  The only change has been the install/apply of some group PTF's
> and a FSP firmware PTF (EL340_101).
>
> IBM says "not us".   The local port number changes but remote is
always
> 25 (SMTP).  The IP address is securehost.com in the Bahamas - that's
> scary enough.
>
> I've looked at SMTP journals and not found anything I can tie to this.
>
> Any thoughts?
>
> Thanks.
>
> ======================================================
>  Message ID . . . . . . :   TCP2617       Severity . . . . . . . :  
20
>  Message type . . . . . :   Diagnostic
>
>  Date sent  . . . . . . :   12/03/09      Time sent  . . . . . . :
> 09:03:18
>
>
>  Message . . . . :   TCP/IP connection to remote system 208.87.32.74
> closed,
>   reason code 2.
>
>  Cause . . . . . :   The TCP/IP connection to remote system
208.87.32.74
> has
>   been closed. The connection was closed for reason code 2.  Full
> connection
>   details for the closed connection include:
>
>     - local IP address is 10.100.40.1
>
>     - local port is 53799
>
>     - remote IP address is 208.87.32.74
>
>     - remote port is 25
>
> ======================================================
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.