Re: runaway client access. was system under attack?

I have a feeling that this is just a bug, pure and simple, and one that
is probably fixed in the current service pack.  You can try it and see
if it does the trick.  Should be easy to reproduce :)

It would be nice if you could have NetServer working because it does
nice things for non-CA (and CA) users.

Gary

srichter wrote:
> 
> Neil,
> 
> Good question. The ibm tech suspected the same thing. He had me check it from 
>ops navigator.  There was no conflict.
> 
> This was a very nasty bug. All because we ran "StrTcpSvr *NetSvr".
> 
> fyi: The ibm tech did not tell me of a ptf that corrects this problem.
> 
> -Steve
> 
> ---------- Original Message ----------------------------------
> From: neilp@dpslink.com
> Reply-To: midrange-l@midrange.com
> Date: Thu, 16 Aug 2001 17:47:13 -0400
> 
> >As you are using the old CA for Win95/NT with it's own network drive
> >support, and starting Net Server, do you possible have a conflict by using
> >the same name for NetServer as you are using for CA network drives.  (ie.
> >not using the "default" of Q + system name for NetServer or some other
> >unique name).
> >
> >...Neil
> >
> >
> >
> >
> >
> >"srichter " <srichter@mail.autocoder.com>
> >Sent by: midrange-l-admin@midrange.com
> >2001/08/16 15:29
> >Please respond to midrange-l
> >
> >
> >        To:     <midrange-l@midrange.com>
> >        cc:
> >        Subject:        Re: runaway client access. was system under attack?
> >
> >
> >Gary, Jeffrey,
> >
> >We use client access v3r2m1 sf57702 in the remote branches. Our 720 is at
> >v4r4.
> >
> >Two of the branches use it to print to a network printer: client access
> >print screen button, print from excel, ...
> >
> >Yesterday, a local pgmr ( not me<g> ) was trying to get network printing
> >to work from cae. That person ran StrTcpSvr *NetSvr on the as400.
> >
> >>From that point on the prior described problem and symptoms occured. Pc's
> >hung when they tried to print, qpwfservso jobs running without end on the
> >as400, lots of netstat activity, reams of cpiad09, cpiad12 msgs in the
> >history log.
> >
> >Talked to a good tech at ibm support named Shane. He had me EndTcpSvr
> >*NetSvr.  Problem gone.
> >
> >End of story.
> >
> >Thanks for the help,
> >
> >Steve
> >
> >---------- Original Message ----------------------------------
> >From: Gary L Peskin <garyp@firstech.com>
> >Reply-To: midrange-l@midrange.com
> >Date: Thu, 16 Aug 2001 10:51:41 -0700
> >
> >>Is it still from the same single IP address?  Perhaps you could find out
> >>who that is and have him/her update to the latest service pack.  In the
> >>meantime, you can stop the flood and filter out traffic to the 400 using
> >>Operations Navigator and IP filtering.
> >>
> >>gary
> >>
> >>srichter wrote:
> >>>
> >>> You were right Gary.
> >>>
> >>> The problem is something with client access and the 400.
> >>>
> >>> The short term fix was to EndHostSvr *SvrMap, wait/help the "as-svrmap"
> >netstat entries to end, then StrHostSvr *SvrMap.
> >>>
> >>> When I did that at 12pm today, there were 8 QPWFSERVSO jobs in
> >WrkSysAct using 40% of our very fast 720.  With 10's of thousands of
> >CPIAD09 and CPIAD12 msgs in the history log.
> >>>
> >>> Now I look on the system an hour later, and its back.  So, its time to
> >get back on the phone to ibm.
> >>>
> >>> Steve Richter
> >>>
> >>> ---------- Original Message ----------------------------------
> >>> From: Gary L Peskin <garyp@firstech.com>
> >>> Reply-To: midrange-l@midrange.com
> >>> Date: Wed, 15 Aug 2001 21:11:15 -0700
> >>>
> >>> >Steve --
> >>> >
> >>> >I'm sure you know this (from WRKSRVTBLE) but the ports are as follows:
> >>> >
> >>> >  139 - Netbios (Network Neighborhood/NetServer)
> >>> >  449 - Server mapper
> >>> > 8470 - Central server
> >>> > 8473 - File server
> >>> >
> >>> >I've already mentioned the File server.  The central server is used
> >for
> >>> >license management and ASCII<->EBCDIC conversion so I'm pretty
> >>> >comfortable that we have an errant Client Access Express issue here.
> >>> >
> >>> >You can filter out all traffic from the offending IP address using
> >>> >Operations Navigator as described here:
> >>>
> 
>>>http://publib.boulder.ibm.com/pubs/html/as400/v4r5/ic2924/info/RZAJBRZAJBX1CREATINGNEWRULESSD.HTM#HDRRZAJBX1-CREATING_NEW_RULES_SD
> >>> >
> >>> >Then, just wait for a call in the morning from someone complaining
> >that
> >>> >they can't connect to the 400.
> >>> >
> >>> >Gary
> >>> >
> >>> >srichter wrote:
> >>> >>
> >>> >> Jeffrey,
> >>> >>
> >>> >> The branch/site that is the source of the trouble only has win95
> >pc's.  Only 1 pc shows up with activity in NetStat right now. NetStat
> >shows the local port as 139, 449, 8470 and 8473. Mostly 449 ( as-svrmap ).
> >The remote port keeps on incrementing by 2 within the range of 1500 to
> >4000.
> >>> >>
> >>> >> Steve Richter
> >
> >
> >
> >
> >_______________________________________________
> >This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> >To post a message email: MIDRANGE-L@midrange.com
> >To subscribe, unsubscribe, or change list options,
> >visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> >or email: MIDRANGE-L-request@midrange.com
> >
> >
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com