Re: runaway client access. was system under attack?

As you are using the old CA for Win95/NT with it's own network drive 
support, and starting Net Server, do you possible have a conflict by using 
the same name for NetServer as you are using for CA network drives.  (ie. 
not using the "default" of Q + system name for NetServer or some other 
unique name).

...Neil





"srichter " <srichter@mail.autocoder.com>
Sent by: midrange-l-admin@midrange.com
2001/08/16 15:29
Please respond to midrange-l

 
        To:     <midrange-l@midrange.com>
        cc: 
        Subject:        Re: runaway client access. was system under attack?


Gary, Jeffrey,

We use client access v3r2m1 sf57702 in the remote branches. Our 720 is at 
v4r4.

Two of the branches use it to print to a network printer: client access 
print screen button, print from excel, ...

Yesterday, a local pgmr ( not me<g> ) was trying to get network printing 
to work from cae. That person ran StrTcpSvr *NetSvr on the as400. 

>From that point on the prior described problem and symptoms occured. Pc's 
hung when they tried to print, qpwfservso jobs running without end on the 
as400, lots of netstat activity, reams of cpiad09, cpiad12 msgs in the 
history log. 

Talked to a good tech at ibm support named Shane. He had me EndTcpSvr 
*NetSvr.  Problem gone.

End of story.

Thanks for the help,

Steve

---------- Original Message ----------------------------------
From: Gary L Peskin <garyp@firstech.com>
Reply-To: midrange-l@midrange.com
Date: Thu, 16 Aug 2001 10:51:41 -0700

>Is it still from the same single IP address?  Perhaps you could find out
>who that is and have him/her update to the latest service pack.  In the
>meantime, you can stop the flood and filter out traffic to the 400 using
>Operations Navigator and IP filtering.
>
>gary
>
>srichter wrote:
>> 
>> You were right Gary.
>> 
>> The problem is something with client access and the 400.
>> 
>> The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap" 
netstat entries to end, then StrHostSvr *SvrMap.
>> 
>> When I did that at 12pm today, there were 8 QPWFSERVSO jobs in 
WrkSysAct using 40% of our very fast 720.  With 10's of thousands of 
CPIAD09 and CPIAD12 msgs in the history log.
>> 
>> Now I look on the system an hour later, and its back.  So, its time to 
get back on the phone to ibm.
>> 
>> Steve Richter
>> 
>> ---------- Original Message ----------------------------------
>> From: Gary L Peskin <garyp@firstech.com>
>> Reply-To: midrange-l@midrange.com
>> Date: Wed, 15 Aug 2001 21:11:15 -0700
>> 
>> >Steve --
>> >
>> >I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
>> >
>> >  139 - Netbios (Network Neighborhood/NetServer)
>> >  449 - Server mapper
>> > 8470 - Central server
>> > 8473 - File server
>> >
>> >I've already mentioned the File server.  The central server is used 
for
>> >license management and ASCII<->EBCDIC conversion so I'm pretty
>> >comfortable that we have an errant Client Access Express issue here.
>> >
>> >You can filter out all traffic from the offending IP address using
>> >Operations Navigator as described here:
>> 
>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
>> >
>> >Then, just wait for a call in the morning from someone complaining 
that
>> >they can't connect to the 400.
>> >
>> >Gary
>> >
>> >srichter wrote:
>> >>
>> >> Jeffrey,
>> >>
>> >> The branch/site that is the source of the trouble only has win95 
pc's.  Only 1 pc shows up with activity in NetStat right now. NetStat 
shows the local port as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ). 
The remote port keeps on incrementing by 2 within the range of 1500 to 
4000.
>> >>
>> >> Steve Richter