Strange Netbios connections

Hi,

yesterday, we had some strange netbios TCP/IP connections on our AS/400's (both 
of them). 
A PC from a remote WAN location was connecting on port 445 to internal 
ip-addresses of our 
810 and 820.

Funny thing is, the PC didn't connect to our official AS/400 addresses, but 
internal ones. For 
example, our 810 has xxx.60.66.61 as its main address (officially in the DNS) 
and 
xxx.60.65.201 for internal use (second ethernet interface). The connection was 
going to the 
65.201 address, but Netserver is running on the 66.61.

We have the IP-address of the offender(?) and are investigating internally. 

Also, before these netbios connections, I saw 2 dropped connections (in 
qsysopr) from 
addresses 10.0.0.100 and 169.254.xxx.xxx.

Netstat *cnn showed only minmal traffic (a few 100 bytes) on those port 445 
connections. 
Once again, the remote PC was connecting to port 445 on both AS/400s.

Any ideas what this could have been? I regularly look at netstat *cnn and know 
the IP-address 
which show up there. I never have seen such connections before.

Can I restrict Netserver to a specific ethernet interface?

Thanks,

Oliver