Re: runaway client access. was system under attack?

Is it still from the same single IP address?  Perhaps you could find out
who that is and have him/her update to the latest service pack.  In the
meantime, you can stop the flood and filter out traffic to the 400 using
Operations Navigator and IP filtering.

gary

srichter wrote:
> 
> You were right Gary.
> 
> The problem is something with client access and the 400.
> 
> The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap" 
>netstat entries to end, then StrHostSvr *SvrMap.
> 
> When I did that at 12pm today, there were 8 QPWFSERVSO jobs in WrkSysAct 
>using 40% of our very fast 720.  With 10's of thousands of CPIAD09 and CPIAD12 
>msgs in the history log.
> 
> Now I look on the system an hour later, and its back.  So, its time to get 
>back on the phone to ibm.
> 
> Steve Richter
> 
> ---------- Original Message ----------------------------------
> From: Gary L Peskin <garyp@firstech.com>
> Reply-To: midrange-l@midrange.com
> Date: Wed, 15 Aug 2001 21:11:15 -0700
> 
> >Steve --
> >
> >I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
> >
> >  139 - Netbios (Network Neighborhood/NetServer)
> >  449 - Server mapper
> > 8470 - Central server
> > 8473 - File server
> >
> >I've already mentioned the File server.  The central server is used for
> >license management and ASCII<->EBCDIC conversion so I'm pretty
> >comfortable that we have an errant Client Access Express issue here.
> >
> >You can filter out all traffic from the offending IP address using
> >Operations Navigator as described here:
> 
>>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
> >
> >Then, just wait for a call in the morning from someone complaining that
> >they can't connect to the 400.
> >
> >Gary
> >
> >srichter wrote:
> >>
> >> Jeffrey,
> >>
> >> The branch/site that is the source of the trouble only has win95 pc's.  
>Only 1 pc shows up with activity in NetStat right now. NetStat shows the local 
>port as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ). The remote port 
>keeps on incrementing by 2 within the range of 1500 to 4000.
> >>
> >> Steve Richter
> >_______________________________________________
> >This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> >To post a message email: MIDRANGE-L@midrange.com
> >To subscribe, unsubscribe, or change list options,
> >visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> >or email: MIDRANGE-L-request@midrange.com
> >
> >
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com