Wireshark-users: Re: [Wireshark-users] Very strange SSH probe
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Tue, 13 Jul 2010 13:53:08 +1000
Michael Glenn wrote:
> Anyone else seeing this? 
>  
> Every five to six minutes, my Linux boxes are seeing a single connection attempt via SSH. What makes this unusual is that the user ID is always 'test1' and the source IPs are all over the map; I don't think I've seen the same IP address twice yet. 

I don't get them every few minutes because for a number of years I have
been using an automated process to add compete suballocations which have
had IP addresses send ssh probes to the firewall rules.

It is down to about a dozen a day.
-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who