I'm getting hundreds of failed login attempts (as reported on our NetWare LDAP server in NRM). It lists the IP of our OES2 Linux server and the account as the sambaproxy account.

However, I don't see anything on the DSTRACE LDAP traces for this user or IP, so I'm not sure if it's an LDAP or other connection (ie, NCP).

This is OES2, not OES2 SP1.