ADSM-L

Re: Session GHOST

2000-07-12 11:23:00
Subject: Re: Session GHOST
From: Richard Sims <rbs AT BU DOT EDU>
Date: Wed, 12 Jul 2000 11:23:00 -0400
>Every second one session for node () open and generate an protocol error.

>07/12/00 11:45:25     ANR0440W Protocol error on session 70919 for node  () -
>                       invalid verb header received.

Alessio - The situation gives the appearance of some random system on the net
          trying to connect to your *SM server port (default: 1500), but not
in *SM terms.  Someone out there may have erroneously set up some kind of
mail client or the like to periodically poll what it thinks is a mail server
for new mail, using your port number.  First assure that you have not
configured your server to use a port number well-known for some other
service.  They you'll have to use some kind of network/packet trace or the
like to determine where it's coming from, as in using the Unix 'tcpdump'
command or AIX 'iptrace'.  (You should be prepared to do this in any case:
any site on the net could be subject to Denial Of Service attacks, and
needs to be ready to find out where they are coming from so has to have
their router filter out traffic from that IP address.)
    Richard Sims, BU
<Prev in Thread] Current Thread [Next in Thread>