Wireshark · Wireshark-users: Re: [Wireshark-users] TCP Retransmission question

[Shain Singh <shain.singh@xxxxxxxxx>]

xxx.xxx.xxx.112 68.168.113.155  SSH     [TCP Retransmission] Encrypted
response packet len=35
68.168.113.155  xxx.xxx.xxx.112 TCP     [TCP Previous segment lost] 33514 >
ssh [ACK] Seq=21 Ack=36 Win=5888 Len=0 TSV=3950744190 TSER=4316095
SLE=1 SRE=36
68.168.113.155  xxx.xxx.xxx.112 SSHv2   [TCP Retransmission] Client
Protocol: SSH-2.0-libssh-0.1\r

Haver you got SSH configured on the host computer to port forward to the servers (Are the virtual hosts in bridged or NAT mode?) - Looks to be bridged.

I would have thought that this could just be someone 'trying' to brute force SSH. It doesn't necessarily mean they have been able to successfully connect from the logs above unless I am missing something.

Have a scroll through you logs for successful/unsuccessful attempts on SSH.

 

-- 
Shaineel Singh
e: shain.singh@xxxxxxxxx
p: +61 422 921 951
w: http://buffet.shainsingh.com

--
"Too many have dispensed with generosity to practice charity" - Albert Camus