Re: Security Question

[Vern Hamberg <hambergv@xxxxxxxxxxxxxx>]

At 02:17 PM 8/11/97 -0500, you wrote:
>Hello,
>
>We had an invalid access attempt appear on one of our virtual device
>descriptions.  Is there any way to track the IP address where it
>originated?
>
>
>-- 
>Kirk R. Yates                          Pattonville School District

I just saw something on IP addresses in the AS400 newgroup, 
        
        comp.sys.ibm.as400.misc

A certain Michael Coppert relayed the following from 'a good friend' (his
words):

Check out the following PTF's:

V3R2 - SF38876, SF38885 and associated co/prereqs
V3R7 - SF37172, SF38535 and associated co/prereqs

SF38876 & SF37172 contain the actual change that gets the IP address for a
QPADEVnnnn device coming in via TELNET or PC5250 (in Win95 Client Access
over TCP/IP). The fix is a modification of the API QDCRDEVD (Retrieve
Device Description). Its DEVD0600 format is extended to return 3 more
fields, viz., Network Protocol, Network Protocol Address, & dotted-decimal
IP address.

We've needed this for a long time, and IBM finally came out with it. It has
mostly to do with the 'thin client' network computers, but we can use it, too.

It works great! But be very sure to get the cover letter for the V3R2
PTF's, esp. SF38876, because that's the one that documents the changes to
QDCRDEVD. None of the V3R7 cover letters tell you anything about it.

This only works for TELNET (and PC5250, which is TELNET, too). WSG
(Workstation Gateway) can still be a problem. We have signon screens that
WSG does not recognize and, ergo, does not get the device name. There _is_
a log for WSG (you have to turn it on with CHGWSGA) that has client IP
address, server IP address, and device name, but only if it can pull it out
of the 5250 stream. Personally, I think they should be able to get it from
their call to the Virtual Display API's, but ????

Good luck


Vernon Hamberg
System Software Programmer
Old Republic National Title Insurance Company
400 Second Avenue South
Minneapolis, MN 55401
(612) 371-1111 x480
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* This is the Midrange System Mailing List!  To submit a new message,   *
* send your mail to "MIDRANGE-L@midrange.com".  To unsubscribe from     *
* this list send email to MAJORDOMO@midrange.com and specify            *
* 'unsubscribe MIDRANGE-L' in the body of your message.  Questions      *
* should be directed to the list owner / operator: david@midrange.com   *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *