>>Geoff - Do 'telnet <YourTSMserverSystem> 1500' and you'll get an idea
>>        where such things are coming from: inappropriate TCP
>>connections.  Use an OS tool (netstat, lsof) to see the origin of
>>the interloper.
>>   Richard Sims
>
>Thanks for the input Richard. I found it using netstat but I guess I don't
>understand the TSM side of this. Typically when a node tries to connect to
>TSM with node unknown to it you will see the session rejection in the
>activity log. In this case TSM showed a session connected with no node name.
>I have never seen a connected session with no node name before and no
>activity log entry for that session number.

It will depend upon what the contactee expects...
A basic TCP connection precedes session establishment, such that the
server will be waiting for that to happen.  So, the server can't
reject on the basis of "node not registered" because the alleged
client has not gotten far enough to interact and provide a node name.
The "session" remains very preliminary and unfulfilled.

  Richard Sims