Backup Central

Tsm client 6.2.3 and 6.2.4 both win 2008.

Receiving messages

04/04/2012 14:42:49 ANS0361I DIAG: sessRecvVerb(): Invalid verb received.
04/04/2012 14:42:49 ANS0361I DIAG: sessRecvVerb(): length=4745, verb=54,magic=20
04/04/2012 14:42:50 ANS0361I DIAG: sessRecvVerb(): Invalid verb received.
04/04/2012 14:42:50 ANS0361I DIAG: sessRecvVerb(): length=4845, verb=41,magic=44
04/04/2012 14:43:07 ANS0361I DIAG: sessRecvVerb(): Invalid verb received.
04/04/2012 14:43:07 ANS0361I DIAG: sessRecvVerb(): length=0000, verb=00,magic=02
04/04/2012 14:43:08 ANS0361I DIAG: sessRecvVerb(): Invalid verb received.
04/04/2012 14:43:08 ANS0361I DIAG: sessRecvVerb(): length=00c8, verb=00,magic=00

When I look in the server log, there is no record of any communications during the specified time period.
Tsm server 5.5.4.
Soon to be upgraded to 6.3 (I hope.

Tried searching ibm site, no success.

Thanks for any assistance.



Gary Lee
Senior System Programmer
Ball State University
phone: 765-285-1310

=

Gary - You probably have some Internet miscreant going at your client port with non-TSM software. Windows boxes tend to be honeypots without trying. Various systems at your site may evidence such probing, in their logs. Given that you are at a recent TSM level, it should not be the case of more advanced TSM software attempting to access a lower level implementation using verbs not understood by the older client.

Richard Sims

I actually saw a flood of these type messages across multiple systems...
enough to where I raised a red flag and declared a potential virus attack.
Within minutes of sounding the alarm it was discovered that it was actually
the anti-virus team performing a "vulnerability test" of the environments.
(would have been nice if they had given me a heads up on that...)

-----Original Message-----
From: ADSM: Dist Stor Manager [mailto:ADSM-L < at > VM.MARIST.EDU] On Behalf Of
Richard Sims
Sent: Wednesday, April 04, 2012 2:32 PM
To: ADSM-L < at > VM.MARIST.EDU
Subject: Re: [ADSM-L] Another queer error message

Gary - You probably have some Internet miscreant going at your client port
with non-TSM software. Windows boxes tend to be honeypots without trying.
Various systems at your site may evidence such probing, in their logs.
Given that you are at a recent TSM level, it should not be the case of more
advanced TSM software attempting to access a lower level implementation
using verbs not understood by the older client.

Richard Sims