runaway client access. was system under attack?

You were right Gary.

The problem is something with client access and the 400.

The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap" netstat 
entries to end, then StrHostSvr *SvrMap.

When I did that at 12pm today, there were 8 QPWFSERVSO jobs in WrkSysAct using 
40% of our very fast 720.  With 10's of thousands of CPIAD09 and CPIAD12 msgs 
in the history log.

Now I look on the system an hour later, and its back.  So, its time to get back 
on the phone to ibm.

Steve Richter


---------- Original Message ----------------------------------
From: Gary L Peskin <garyp@firstech.com>
Reply-To: midrange-l@midrange.com
Date: Wed, 15 Aug 2001 21:11:15 -0700

>Steve --
>
>I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
>
>  139 - Netbios (Network Neighborhood/NetServer)
>  449 - Server mapper
> 8470 - Central server
> 8473 - File server
>
>I've already mentioned the File server.  The central server is used for
>license management and ASCII<->EBCDIC conversion so I'm pretty
>comfortable that we have an errant Client Access Express issue here.
>
>You can filter out all traffic from the offending IP address using
>Operations Navigator as described here: 
>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
>
>Then, just wait for a call in the morning from someone complaining that
>they can't connect to the 400.
>
>Gary 
>
>srichter wrote:
>> 
>> Jeffrey,
>> 
>> The branch/site that is the source of the trouble only has win95 pc's.  Only 
>1 pc shows up with activity in NetStat right now. NetStat shows the local port 
>as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ). The remote port keeps on 
>incrementing by 2 within the range of 1500 to 4000.
>> 
>> Steve Richter
>_______________________________________________
>This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
>To post a message email: MIDRANGE-L@midrange.com
>To subscribe, unsubscribe, or change list options,
>visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
>or email: MIDRANGE-L-request@midrange.com
>
>