system under attack?

Hi,

The shop I work at has a central as400 720 that is completely behind a pix 
firewall. No internet access allowed to it at all.  We also have win95/98 pc's 
that are located in branches throughout the country. These pc's are networked 
to each other and to the central as400 using ethernet lan and cisco routers.

The pc's have internet access thru a central T1 line.  The pc's are also behind 
the firewall, so they can get out to the internet, but nothing can get in.

The pc's, behind the firewall like the as400, have unfettered network access to 
the central as400.

Right now, NetStat on the 720 is showing something like this:

 Remote         Remote Local
 Address        Port   Port      Idle Time State
 172.24.105.115 2524   as-cent > 003:23:58 Established         
 172.24.105.115 2727   as-svrmap 000:01:08 Time-wait           
 172.24.105.115 2729   as-svrmap 000:01:07 Time-wait           
 172.24.105.115 2731   as-svrmap 000:01:06 Time-wait           

7 pages worth of it. about 80 entries.  all from 172.24.105.115 ( a pc in a 
remote branch ). We see local port entries of "netbios-san", "as-svrmap", 
"as-central" and "as-file".  The remote port nbr increments by 2 on each line.  
3481, 3483, 3485, 3487, ...

A job named "QPWFSERVSO" is continuously running and is using 5% of a very fast 
720.

The history log has scores of CPIAD09 and CPIAD12 entries, like the following: 
( every second we get another msg )
 Message ID . . . . . . :   CPIAD12      Severity . . . . . . . :   00
 Message type . . . . . :   Information
 Date sent  . . . . . . :   08/15/01  Time sent  . . . . . . : 19:29:29

 Message . . . . : Servicing user profile xx from client 172.24.105.115.
     
 Cause . . . . . :This prestart job is currently servicing requests for user 
profile SSM from client 172.24.105.115.  The client name is either an APPC 
remote location name, or a TCP/IP remote system name.

Any idea what is going on?


Thanks,

Steve Richter