Re: 5250 sessions killing the system

[Jeff Crosby <jlcrosby@xxxxxxxxxxxxxxxx>]

Did this just start today?  Bizarre.

On Thu, Nov 14, 2019 at 2:15 PM Rob Berendt <rob@xxxxxxxxx> wrote:

> They also said that I may want to turn off auto reconnect on those clients.
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
> -----Original Message-----
> From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob
> Berendt
> Sent: Thursday, November 14, 2019 2:06 PM
> To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
> Subject: 5250 sessions killing the system
>
> I have this case opened with IBM.  There are certain clients attaching to
> the system where it starts 10,000+ port 23 (telnet) connections to our
> system.  All using the same 1-3 workstation id's.  Totally blows our
> activity level out of the water and is quite an effective denial of service
> attack.
>
> -- Some TCP connections do not spawn "jobs".  Therefore we'll use a
> different service.
> select local_port, remote_address, count(*) as nbrconnections
> from gdihq.qsys2.NS_INFO
> where local_port = 23
> group by local_port, remote_address
> having count(*) > 10
> ;
>
> Messing with things like QAUTOCFG, QAUTOVRT has ZERO effect on stopping
> this.
>
> IBM's reply has been basically put on a patch to that version of the
> deprecated Client Access or upgrade to iACS.
>
> Since most of these are Windows 7 VM sessions our Windows admins are
> leaning towards the patch.  When they are ready to upgrade to Windows 10 on
> the 'gold' image they'll upgrade to iACS.
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>          6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com