Re: system under attack?

Steve,

        I would look for a Windoze or UNIX/SMB server that is down, that
normally supplies a mount to the systems on this segment.  I think you are
seeing a client attempting to re-mount a shared disk partition somewhere,
and your iSeries box is seeing the requests.  NOTE: There is a major change
to these messages in V4R5 documented in the Memo to users.  You could/should
look at your routers to see what ports are being passed, and if you are not
mounting any of the IFS stuff close off these requests with a deny rule.

        Also, you could do an Exit program to drop theseon the floor, but
depending on the volume this could busy the connection to the point of
becoming a Denial-of-service storm so I would rather see you block it on the
router..

    From the Web Site Document : http://www.faqs.org/faqs/firewalls-faq/
For example, a web server running on NT might be vulnerable to a number of
denial-of-service attacks against such services as RPC, NetBIOS and SMB.
These services are not required for the operation of a web server, so
blocking TCP connections to ports 135, 137, 138, and 139 on that host will
reduce the exposure to a denial-of-service attack.

HUM: Second night in a row of I quoted from here !!

Jeffrey M. Silberberg
Independent Consultant
CompuDesigns, Inc.

AS SOON AS I KNOW THE ANSWERS
THEY CHANGE THE QUESTIONS





----- Original Message -----
From: srichter <srichter@mail.autocoder.com>
To: <midrange-l@midrange.com>
Sent: Wednesday, August 15, 2001 10:21 PM
Subject: Re: system under attack?


> >Depending on your version of OS/400, there may be PTFs to fix your
> >problem.  See, for example, PTF SF60551.  What version of OS/400 are you
>
> v4r4.
> ptf sf60551 is perm applied.
>
> Its pretty wild.
> With all the msgs, the system is creating an 800k history log file every
15 minutes.
> I asked the night person at the branch to power off all the pc's. And the
NetStat activity continues.  He must have missed a pc.
> I vary off all the devices and controllers, no chg. ( pc must be ip
connected instead of netsoft )
> When I hold the "QPWFSERVSO" job, the NetStat activity stops. But we
released it again because we dont know what the job does and the impact of
holding it.
>
> The plan is to call ibm in the morning.
>
> Thanks Gary,
>
> Steve Richter
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
>