Re: runaway client access. was system under attack?

Neil,

Good question. The ibm tech suspected the same thing. He had me check it from 
ops navigator.  There was no conflict.

This was a very nasty bug. All because we ran "StrTcpSvr *NetSvr". 

fyi: The ibm tech did not tell me of a ptf that corrects this problem.

-Steve

---------- Original Message ----------------------------------
From: neilp@dpslink.com
Reply-To: midrange-l@midrange.com
Date: Thu, 16 Aug 2001 17:47:13 -0400

>As you are using the old CA for Win95/NT with it's own network drive 
>support, and starting Net Server, do you possible have a conflict by using 
>the same name for NetServer as you are using for CA network drives.  (ie. 
>not using the "default" of Q + system name for NetServer or some other 
>unique name).
>
>...Neil
>
>
>
>
>
>"srichter " <srichter@mail.autocoder.com>
>Sent by: midrange-l-admin@midrange.com
>2001/08/16 15:29
>Please respond to midrange-l
>
> 
>        To:     <midrange-l@midrange.com>
>        cc: 
>        Subject:        Re: runaway client access. was system under attack?
>
>
>Gary, Jeffrey,
>
>We use client access v3r2m1 sf57702 in the remote branches. Our 720 is at 
>v4r4.
>
>Two of the branches use it to print to a network printer: client access 
>print screen button, print from excel, ...
>
>Yesterday, a local pgmr ( not me<g> ) was trying to get network printing 
>to work from cae. That person ran StrTcpSvr *NetSvr on the as400. 
>
>>From that point on the prior described problem and symptoms occured. Pc's 
>hung when they tried to print, qpwfservso jobs running without end on the 
>as400, lots of netstat activity, reams of cpiad09, cpiad12 msgs in the 
>history log. 
>
>Talked to a good tech at ibm support named Shane. He had me EndTcpSvr 
>*NetSvr.  Problem gone.
>
>End of story.
>
>Thanks for the help,
>
>Steve
>
>---------- Original Message ----------------------------------
>From: Gary L Peskin <garyp@firstech.com>
>Reply-To: midrange-l@midrange.com
>Date: Thu, 16 Aug 2001 10:51:41 -0700
>
>>Is it still from the same single IP address?  Perhaps you could find out
>>who that is and have him/her update to the latest service pack.  In the
>>meantime, you can stop the flood and filter out traffic to the 400 using
>>Operations Navigator and IP filtering.
>>
>>gary
>>
>>srichter wrote:
>>> 
>>> You were right Gary.
>>> 
>>> The problem is something with client access and the 400.
>>> 
>>> The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap" 
>netstat entries to end, then StrHostSvr *SvrMap.
>>> 
>>> When I did that at 12pm today, there were 8 QPWFSERVSO jobs in 
>WrkSysAct using 40% of our very fast 720.  With 10's of thousands of 
>CPIAD09 and CPIAD12 msgs in the history log.
>>> 
>>> Now I look on the system an hour later, and its back.  So, its time to 
>get back on the phone to ibm.
>>> 
>>> Steve Richter
>>> 
>>> ---------- Original Message ----------------------------------
>>> From: Gary L Peskin <garyp@firstech.com>
>>> Reply-To: midrange-l@midrange.com
>>> Date: Wed, 15 Aug 2001 21:11:15 -0700
>>> 
>>> >Steve --
>>> >
>>> >I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
>>> >
>>> >  139 - Netbios (Network Neighborhood/NetServer)
>>> >  449 - Server mapper
>>> > 8470 - Central server
>>> > 8473 - File server
>>> >
>>> >I've already mentioned the File server.  The central server is used 
>for
>>> >license management and ASCII<->EBCDIC conversion so I'm pretty
>>> >comfortable that we have an errant Client Access Express issue here.
>>> >
>>> >You can filter out all traffic from the offending IP address using
>>> >Operations Navigator as described here:
>>> 
>>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
>>> >
>>> >Then, just wait for a call in the morning from someone complaining 
>that
>>> >they can't connect to the 400.
>>> >
>>> >Gary
>>> >
>>> >srichter wrote:
>>> >>
>>> >> Jeffrey,
>>> >>
>>> >> The branch/site that is the source of the trouble only has win95 
>pc's.  Only 1 pc shows up with activity in NetStat right now. NetStat 
>shows the local port as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ). 
>The remote port keeps on incrementing by 2 within the range of 1500 to 
>4000.
>>> >>
>>> >> Steve Richter
>
>
>
>
>_______________________________________________
>This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
>To post a message email: MIDRANGE-L@midrange.com
>To subscribe, unsubscribe, or change list options,
>visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
>or email: MIDRANGE-L-request@midrange.com
>
>